secure_headers 3.1.2 → 3.3.0

data/lib/secure_headers/middleware.rb

@@ -1,6 +1,6 @@
 module SecureHeaders
   class Middleware
-    SECURE_COOKIE_REGEXP = /;\s*secure\s*(;|$)/i.freeze
+    HPKP_SAME_HOST_WARNING = "[WARNING] HPKP report host should not be the same as the request host. See https://github.com/twitter/secureheaders/issues/166"
 
     def initialize(app)
       @app = app
@@ -12,7 +12,11 @@ module SecureHeaders
       status, headers, response = @app.call(env)
 
       config = SecureHeaders.config_for(req)
-      flag_cookies_as_secure!(headers) if config.secure_cookies
+      if config.hpkp_report_host == req.host
+        Kernel.warn(HPKP_SAME_HOST_WARNING)
+      end
+
+      flag_cookies!(headers, override_secure(env, config.cookies)) if config.cookies
       headers.merge!(SecureHeaders.header_hash_for(req))
       [status, headers, response]
     end
@@ -20,19 +24,35 @@ module SecureHeaders
     private
 
     # inspired by https://github.com/tobmatth/rack-ssl-enforcer/blob/6c014/lib/rack/ssl-enforcer.rb#L183-L194
-    def flag_cookies_as_secure!(headers)
+    def flag_cookies!(headers, config)
       if cookies = headers['Set-Cookie']
         # Support Rails 2.3 / Rack 1.1 arrays as headers
         cookies = cookies.split("\n") unless cookies.is_a?(Array)
 
         headers['Set-Cookie'] = cookies.map do |cookie|
-          if cookie !~ SECURE_COOKIE_REGEXP
-            "#{cookie}; secure"
-          else
-            cookie
-          end
+          SecureHeaders::Cookie.new(cookie, config).to_s
         end.join("\n")
       end
     end
+
+    # disable Secure cookies for non-https requests
+    def override_secure(env, config = {})
+      if scheme(env) != 'https'
+        config.merge!(secure: false)
+      end
+
+      config
+    end
+
+    # derived from https://github.com/tobmatth/rack-ssl-enforcer/blob/6c014/lib/rack/ssl-enforcer.rb#L119
+    def scheme(env)
+      if env['HTTPS'] == 'on' || env['HTTP_X_SSL_REQUEST'] == 'on'
+        'https'
+      elsif env['HTTP_X_FORWARDED_PROTO']
+        env['HTTP_X_FORWARDED_PROTO'].split(',')[0]
+      else
+        env['rack.url_scheme']
+      end
+    end
   end
 end

data/lib/secure_headers/railtie.rb

@@ -7,12 +7,16 @@ if defined?(Rails::Railtie)
                              'X-Permitted-Cross-Domain-Policies', 'X-Download-Options',
                              'X-Content-Type-Options', 'Strict-Transport-Security',
                              'Content-Security-Policy', 'Content-Security-Policy-Report-Only',
-                             'Public-Key-Pins', 'Public-Key-Pins-Report-Only']
+                             'Public-Key-Pins', 'Public-Key-Pins-Report-Only', 'Referrer-Policy']
 
       initializer "secure_headers.middleware" do
         Rails.application.config.middleware.insert_before 0, SecureHeaders::Middleware
       end
 
+      rake_tasks do
+        load File.expand_path(File.join('..', '..', 'lib', 'tasks', 'tasks.rake'), File.dirname(__FILE__))
+      end
+
       initializer "secure_headers.action_controller" do
         ActiveSupport.on_load(:action_controller) do
           include SecureHeaders

data/lib/secure_headers/utils/cookies_config.rb

@@ -0,0 +1,94 @@
+module SecureHeaders
+  class CookiesConfig
+
+    attr_reader :config
+
+    def initialize(config)
+      @config = config
+    end
+
+    def validate!
+      return if config.nil? || config == SecureHeaders::OPT_OUT
+
+      validate_config!
+      validate_secure_config! if config[:secure]
+      validate_httponly_config! if config[:httponly]
+      validate_samesite_config! if config[:samesite]
+    end
+
+    private
+
+    def validate_config!
+      raise CookiesConfigError.new("config must be a hash.") unless is_hash?(config)
+    end
+
+    def validate_secure_config!
+      validate_hash_or_boolean!(:secure)
+      validate_exclusive_use_of_hash_constraints!(config[:secure], :secure)
+    end
+
+    def validate_httponly_config!
+      validate_hash_or_boolean!(:httponly)
+      validate_exclusive_use_of_hash_constraints!(config[:httponly], :httponly)
+    end
+
+    def validate_samesite_config!
+      raise CookiesConfigError.new("samesite cookie config must be a hash") unless is_hash?(config[:samesite])
+
+      validate_samesite_boolean_config!
+      validate_samesite_hash_config!
+    end
+
+    # when configuring with booleans, only one enforcement is permitted
+    def validate_samesite_boolean_config!
+      if config[:samesite].key?(:lax) && config[:samesite][:lax].is_a?(TrueClass) && config[:samesite].key?(:strict)
+        raise CookiesConfigError.new("samesite cookie config is invalid, combination use of booleans and Hash to configure lax and strict enforcement is not permitted.")
+      elsif config[:samesite].key?(:strict) && config[:samesite][:strict].is_a?(TrueClass) && config[:samesite].key?(:lax)
+        raise CookiesConfigError.new("samesite cookie config is invalid, combination use of booleans and Hash to configure lax and strict enforcement is not permitted.")
+      end
+    end
+
+    def validate_samesite_hash_config!
+      # validate Hash-based samesite configuration
+      if is_hash?(config[:samesite][:lax])
+        validate_exclusive_use_of_hash_constraints!(config[:samesite][:lax], 'samesite lax')
+
+        if is_hash?(config[:samesite][:strict])
+          validate_exclusive_use_of_hash_constraints!(config[:samesite][:strict], 'samesite strict')
+          validate_exclusive_use_of_samesite_enforcement!(:only)
+          validate_exclusive_use_of_samesite_enforcement!(:except)
+        end
+      end
+    end
+
+    def validate_hash_or_boolean!(attribute)
+      if !(is_hash?(config[attribute]) || is_boolean?(config[attribute]))
+        raise CookiesConfigError.new("#{attribute} cookie config must be a hash or boolean")
+      end
+    end
+
+    # validate exclusive use of only or except but not both at the same time
+    def validate_exclusive_use_of_hash_constraints!(conf, attribute)
+      return unless is_hash?(conf)
+
+      if conf.key?(:only) && conf.key?(:except)
+        raise CookiesConfigError.new("#{attribute} cookie config is invalid, simultaneous use of conditional arguments `only` and `except` is not permitted.")
+      end
+    end
+
+    # validate exclusivity of only and except members within strict and lax
+    def validate_exclusive_use_of_samesite_enforcement!(attribute)
+      if (intersection = (config[:samesite][:lax].fetch(attribute, []) & config[:samesite][:strict].fetch(attribute, []))).any?
+        raise CookiesConfigError.new("samesite cookie config is invalid, cookie(s) #{intersection.join(', ')} cannot be enforced as lax and strict")
+      end
+    end
+
+    def is_hash?(obj)
+      obj && obj.is_a?(Hash)
+    end
+
+    def is_boolean?(obj)
+      obj && (obj.is_a?(TrueClass) || obj.is_a?(FalseClass))
+    end
+  end
+end

data/lib/secure_headers/view_helper.rb

@@ -1,5 +1,10 @@
 module SecureHeaders
   module ViewHelpers
+    include SecureHeaders::HashHelper
+    SECURE_HEADERS_RAKE_TASK = "rake secure_headers:generate_hashes"
+
+    class UnexpectedHashedScriptException < StandardError; end
+
     # Public: create a style tag using the content security policy nonce.
     # Instructs secure_headers to append a nonce to style/script-src directives.
     #
@@ -29,8 +34,67 @@ module SecureHeaders
       end
     end
 
+    ##
+    # Checks to see if the hashed code is expected and adds the hash source
+    # value to the current CSP.
+    #
+    # By default, in development/test/etc. an exception will be raised.
+    def hashed_javascript_tag(raise_error_on_unrecognized_hash = nil, &block)
+      hashed_tag(
+        :script,
+        :script_src,
+        Configuration.instance_variable_get(:@script_hashes),
+        raise_error_on_unrecognized_hash,
+        block
+      )
+    end
+
+    def hashed_style_tag(raise_error_on_unrecognized_hash = nil, &block)
+      hashed_tag(
+        :style,
+        :style_src,
+        Configuration.instance_variable_get(:@style_hashes),
+        raise_error_on_unrecognized_hash,
+        block
+      )
+    end
+
     private
 
+    def hashed_tag(type, directive, hashes, raise_error_on_unrecognized_hash, block)
+      if raise_error_on_unrecognized_hash.nil?
+        raise_error_on_unrecognized_hash = ENV["RAILS_ENV"] != "production"
+      end
+
+      content = capture(&block)
+      file_path = File.join('app', 'views', self.instance_variable_get(:@virtual_path) + '.html.erb')
+
+      if raise_error_on_unrecognized_hash
+        hash_value = hash_source(content)
+        message = unexpected_hash_error_message(file_path, content, hash_value)
+
+        if hashes.nil? || hashes[file_path].nil? || !hashes[file_path].include?(hash_value)
+          raise UnexpectedHashedScriptException.new(message)
+        end
+      end
+
+      SecureHeaders.append_content_security_policy_directives(request, directive => hashes[file_path])
+
+      content_tag type, content
+    end
+
+    def unexpected_hash_error_message(file_path, content, hash_value)
+      <<-EOF
+\n\n*** WARNING: Unrecognized hash in #{file_path}!!! Value: #{hash_value} ***
+#{content}
+*** Run #{SECURE_HEADERS_RAKE_TASK} or add the following to config/script_hashes.yml:***
+#{file_path}:
+- #{hash_value}\n\n
+      NOTE: dynamic javascript is not supported using script hash integration
+      on purpose. It defeats the point of using it in the first place.
+      EOF
+    end
+
     def nonced_tag(type, content_or_options, block)
       options = {}
       content = if block

data/lib/secure_headers.rb

@@ -1,4 +1,6 @@
 require "secure_headers/configuration"
+require "secure_headers/hash_helper"
+require "secure_headers/headers/cookie"
 require "secure_headers/headers/public_key_pins"
 require "secure_headers/headers/content_security_policy"
 require "secure_headers/headers/x_frame_options"
@@ -7,6 +9,7 @@ require "secure_headers/headers/x_xss_protection"
 require "secure_headers/headers/x_content_type_options"
 require "secure_headers/headers/x_download_options"
 require "secure_headers/headers/x_permitted_cross_domain_policies"
+require "secure_headers/headers/referrer_policy"
 require "secure_headers/middleware"
 require "secure_headers/railtie"
 require "secure_headers/view_helper"
@@ -25,6 +28,7 @@ module SecureHeaders
     ContentSecurityPolicy,
     StrictTransportSecurity,
     PublicKeyPins,
+    ReferrerPolicy,
     XContentTypeOptions,
     XDownloadOptions,
     XFrameOptions,

data/lib/tasks/tasks.rake

@@ -0,0 +1,81 @@
+INLINE_SCRIPT_REGEX = /(<script(\s*(?!src)([\w\-])+=([\"\'])[^\"\']+\4)*\s*>)(.*?)<\/script>/mx
+INLINE_STYLE_REGEX = /(<style[^>]*>)(.*?)<\/style>/mx
+INLINE_HASH_SCRIPT_HELPER_REGEX = /<%=\s?hashed_javascript_tag(.*?)\s+do\s?%>(.*?)<%\s*end\s*%>/mx
+INLINE_HASH_STYLE_HELPER_REGEX = /<%=\s?hashed_style_tag(.*?)\s+do\s?%>(.*?)<%\s*end\s*%>/mx
+
+namespace :secure_headers do
+  include SecureHeaders::HashHelper
+
+  def is_erb?(filename)
+    filename =~ /\.erb\Z/
+  end
+
+  def is_mustache?(filename)
+    filename =~ /\.mustache\Z/
+  end
+
+  def dynamic_content?(filename, inline_script)
+    (is_mustache?(filename) && inline_script =~ /\{\{.*\}\}/) ||
+      (is_erb?(filename) && inline_script =~ /<%.*%>/)
+  end
+
+  def find_inline_content(filename, regex, hashes)
+    file = File.read(filename)
+    file.scan(regex) do # TODO don't use gsub
+      inline_script = Regexp.last_match.captures.last
+      if dynamic_content?(filename, inline_script)
+        puts "Looks like there's some dynamic content inside of a tag :-/"
+        puts "That pretty much means the hash value will never match."
+        puts "Code: " + inline_script
+        puts "=" * 20
+      end
+
+      hashes << hash_source(inline_script)
+    end
+  end
+
+  def generate_inline_script_hashes(filename)
+    hashes = []
+
+    [INLINE_SCRIPT_REGEX, INLINE_HASH_SCRIPT_HELPER_REGEX].each do |regex|
+      find_inline_content(filename, regex, hashes)
+    end
+
+    hashes
+  end
+
+  def generate_inline_style_hashes(filename)
+    hashes = []
+
+    [INLINE_STYLE_REGEX, INLINE_HASH_STYLE_HELPER_REGEX].each do |regex|
+      find_inline_content(filename, regex, hashes)
+    end
+
+    hashes
+  end
+
+  task :generate_hashes do |t, args|
+    script_hashes = {
+      "scripts" => {},
+      "styles" => {}
+    }
+
+    Dir.glob("app/{views,templates}/**/*.{erb,mustache}") do |filename|
+      hashes = generate_inline_script_hashes(filename)
+      if hashes.any?
+        script_hashes["scripts"][filename] = hashes
+      end
+
+      hashes = generate_inline_style_hashes(filename)
+      if hashes.any?
+        script_hashes["styles"][filename] = hashes
+      end
+    end
+
+    File.open(SecureHeaders::Configuration::HASH_CONFIG_FILE, 'w') do |file|
+      file.write(script_hashes.to_yaml)
+    end
+
+    puts "Script hashes from " + script_hashes.keys.size.to_s + " files added to #{SecureHeaders::Configuration::HASH_CONFIG_FILE}"
+  end
+end

data/secure_headers.gemspec

@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "3.1.2"
+  gem.version       = "3.3.0"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = 'Security related headers all in one gem.'

data/spec/lib/secure_headers/configuration_spec.rb

@@ -36,7 +36,7 @@ module SecureHeaders
 
       config = Configuration.get(:test_override)
       noop = Configuration.get(Configuration::NOOP_CONFIGURATION)
-      [:csp, :dynamic_csp, :secure_cookies].each do |key|
+      [:csp, :dynamic_csp, :cookies].each do |key|
         expect(config.send(key)).to eq(noop.send(key)), "Value not copied: #{key}."
       end
     end
@@ -82,5 +82,13 @@ module SecureHeaders
       override_config = Configuration.get(:second_override)
       expect(override_config.csp).to eq(default_src: %w('self'), script_src: %w(example.org))
     end
+
+    it "deprecates the secure_cookies configuration" do
+      expect(Kernel).to receive(:warn).with(/\[DEPRECATION\]/)
+
+      Configuration.default do |config|
+        config.secure_cookies = true
+      end
+    end
   end
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -104,6 +104,11 @@ module SecureHeaders
           expect(policy.value).to eq("default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; sandbox 'self'; script-src 'self' 'nonce-123456'; style-src 'self'; upgrade-insecure-requests; report-uri 'self'")
         end
 
+        it "adds 'unsafe-inline', filters base-uri, blocked-all-mixed-content, upgrade-insecure-requests, child-src, form-action, frame-ancestors, nonce sources, hash sources, and plugin-types for Edge" do
+          policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:edge])
+          expect(policy.value).to eq("default-src 'self'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; sandbox 'self'; script-src 'self' 'unsafe-inline'; style-src 'self'; report-uri 'self'")
+        end
+
         it "adds 'unsafe-inline', filters base-uri, blocked-all-mixed-content, upgrade-insecure-requests, child-src, form-action, frame-ancestors, nonce sources, hash sources, and plugin-types for safari" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:safari6])
           expect(policy.value).to eq("default-src 'self'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; sandbox 'self'; script-src 'self' 'unsafe-inline'; style-src 'self'; report-uri 'self'")

data/spec/lib/secure_headers/headers/cookie_spec.rb

@@ -0,0 +1,164 @@
+require 'spec_helper'
+
+module SecureHeaders
+  describe Cookie do
+    let(:raw_cookie) { "_session=thisisatest" }
+
+    it "does not tamper with cookies when unconfigured" do
+      cookie = Cookie.new(raw_cookie, {})
+      expect(cookie.to_s).to eq(raw_cookie)
+    end
+
+    it "preserves existing attributes" do
+      cookie = Cookie.new("_session=thisisatest; secure", secure: true)
+      expect(cookie.to_s).to eq("_session=thisisatest; secure")
+    end
+
+    it "prevents duplicate flagging of attributes" do
+      cookie = Cookie.new("_session=thisisatest; secure", secure: true)
+      expect(cookie.to_s.scan(/secure/i).count).to eq(1)
+    end
+
+    context "Secure cookies" do
+      context "when configured with a boolean" do
+        it "flags cookies as Secure" do
+          cookie = Cookie.new(raw_cookie, secure: true)
+          expect(cookie.to_s).to eq("_session=thisisatest; secure")
+        end
+      end
+
+      context "when configured with a Hash" do
+        it "flags cookies as Secure when whitelisted" do
+          cookie = Cookie.new(raw_cookie, secure: { only: ["_session"]})
+          expect(cookie.to_s).to eq("_session=thisisatest; secure")
+        end
+
+        it "does not flag cookies as Secure when excluded" do
+          cookie = Cookie.new(raw_cookie, secure: { except: ["_session"] })
+          expect(cookie.to_s).to eq("_session=thisisatest")
+        end
+      end
+    end
+
+    context "HttpOnly cookies" do
+      context "when configured with a boolean" do
+        it "flags cookies as HttpOnly" do
+          cookie = Cookie.new(raw_cookie, httponly: true)
+          expect(cookie.to_s).to eq("_session=thisisatest; HttpOnly")
+        end
+      end
+
+      context "when configured with a Hash" do
+        it "flags cookies as HttpOnly when whitelisted" do
+          cookie = Cookie.new(raw_cookie, httponly: { only: ["_session"]})
+          expect(cookie.to_s).to eq("_session=thisisatest; HttpOnly")
+        end
+
+        it "does not flag cookies as HttpOnly when excluded" do
+          cookie = Cookie.new(raw_cookie, httponly: { except: ["_session"] })
+          expect(cookie.to_s).to eq("_session=thisisatest")
+        end
+      end
+    end
+
+    context "SameSite cookies" do
+      it "flags SameSite=Lax" do
+        cookie = Cookie.new(raw_cookie, samesite: { lax: { only: ["_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
+      end
+
+      it "flags SameSite=Lax when configured with a boolean" do
+        cookie = Cookie.new(raw_cookie, samesite: { lax: true})
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
+      end
+
+      it "does not flag cookies as SameSite=Lax when excluded" do
+        cookie = Cookie.new(raw_cookie, samesite: { lax: { except: ["_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest")
+      end
+
+      it "flags SameSite=Strict" do
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
+      end
+
+      it "does not flag cookies as SameSite=Strict when excluded" do
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { except: ["_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest")
+      end
+
+      it "flags SameSite=Strict when configured with a boolean" do
+        cookie = Cookie.new(raw_cookie, samesite: { strict: true})
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
+      end
+
+      it "flags properly when both lax and strict are configured" do
+        raw_cookie = "_session=thisisatest"
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] }, lax: { only: ["_additional_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
+      end
+
+      it "ignores configuration if the cookie is already flagged" do
+        raw_cookie = "_session=thisisatest; SameSite=Strict"
+        cookie = Cookie.new(raw_cookie, samesite: { lax: true })
+        expect(cookie.to_s).to eq(raw_cookie)
+      end
+    end
+  end
+
+  context "with an invalid configuration" do
+    it "raises an exception when not configured with a Hash" do
+      expect do
+        Cookie.validate_config!("configuration")
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when configured without a boolean/Hash" do
+      expect do
+        Cookie.validate_config!(secure: "true")
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both only and except filters are provided" do
+      expect do
+        Cookie.validate_config!(secure: { only: [], except: [] })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when SameSite is not configured with a Hash" do
+      expect do
+        Cookie.validate_config!(samesite: true)
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when SameSite lax and strict enforcement modes are configured with booleans" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: true, strict: true})
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when SameSite lax and strict enforcement modes are configured with booleans" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: true, strict: { only: ["_anything"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both only and except filters are provided to SameSite configurations" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: { only: ["_anything"], except: ["_anythingelse"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both lax and strict only filters are provided to SameSite configurations" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: { only: ["_anything"] }, strict: { only: ["_anything"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both lax and strict only filters are provided to SameSite configurations" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: { except: ["_anything"] }, strict: { except: ["_anything"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+  end
+end

data/spec/lib/secure_headers/headers/referrer_policy_spec.rb

@@ -0,0 +1,54 @@
+require 'spec_helper'
+
+module SecureHeaders
+  describe ReferrerPolicy do
+    specify { expect(ReferrerPolicy.make_header).to eq([ReferrerPolicy::HEADER_NAME, "origin-when-cross-origin"]) }
+    specify { expect(ReferrerPolicy.make_header('no-referrer')).to eq([ReferrerPolicy::HEADER_NAME, "no-referrer"]) }
+
+    context "valid configuration values" do
+      it "accepts 'no-referrer'" do
+        expect do
+          ReferrerPolicy.validate_config!("no-referrer")
+        end.not_to raise_error
+      end
+
+      it "accepts 'no-referrer-when-downgrade'" do
+        expect do
+          ReferrerPolicy.validate_config!("no-referrer-when-downgrade")
+        end.not_to raise_error
+      end
+
+      it "accepts 'origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'origin-when-cross-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("origin-when-cross-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'unsafe-url'" do
+        expect do
+          ReferrerPolicy.validate_config!("unsafe-url")
+        end.not_to raise_error
+      end
+
+      it "accepts nil" do
+        expect do
+          ReferrerPolicy.validate_config!(nil)
+        end.not_to raise_error
+      end
+    end
+
+    context 'invlaid configuration values' do
+      it "doesn't accept invalid values" do
+        expect do
+          ReferrerPolicy.validate_config!("open")
+        end.to raise_error(ReferrerPolicyConfigError)
+      end
+    end
+  end
+end