Attach Meteor HTTP "Referrer-Policy" Headers

header-referrer-policy.js

Meteor.startup(() => {
    WebApp.connectHandlers.use((req, res, next) => {
        // See https://blog.appcanary.com/2017/http-security-headers.html#referrer-policy for details, 
        // and information around the other possible values for the Referrer-Policy header:
        //  - "no-referrer"
        //  - "no-referrer-when-downgrade"
        //  - "origin"
        //  - "origin-when-cross-origi"
        //  - "same-origin"
        //  - "strict-origin"
        //  - "strict-origin-when-cross-origin"
        //  - "unsafe-url"
        res.setHeader("Referrer-Policy", "no-referrer");
        return next();
    });
});