Merge pull request #832 from tahoe-lafs/3443.referrer-policy-tests

Add a test for referrer-policy

Fixes: ticket:3443

src/allmydata/test/web/test_web.py

@@ -749,20 +749,41 @@ class Web(WebMixin, WebErrorMixin, testutil.StallMixin, testutil.ReallyEqualMixi
     def test_create(self):
         pass
 
-    def test_frame_options(self):
+    def _assertResponseHeaders(self, name, values):
         """
-        All pages deny the ability to be loaded in frames.
+        Assert that the resource at **/** is served with a response header named
+        ``name`` and values ``values``.
+
+        :param bytes name: The name of the header item to check.
+        :param [bytes] values: The expected values.
+
+        :return Deferred: A Deferred that fires successfully if the expected
+            header item is found and which fails otherwise.
         """
         d = self.GET("/", return_response=True)
         def responded(result):
             _, _, headers = result
             self.assertEqual(
-                [b"DENY"],
-                headers.getRawHeaders(b"X-Frame-Options"),
+                values,
+                headers.getRawHeaders(name),
             )
         d.addCallback(responded)
         return d
 
+    def test_frame_options(self):
+        """
+        Pages deny the ability to be loaded in frames.
+        """
+        # It should be all pages but we only demonstrate it for / with this test.
+        return self._assertResponseHeaders(b"X-Frame-Options", [b"DENY"])
+
+    def test_referrer_policy(self):
+        """
+        Pages set a **no-referrer** policy.
+        """
+        # It should be all pages but we only demonstrate it for / with this test.
+        return self._assertResponseHeaders(b"Referrer-Policy", [b"no-referrer"])
+
     def test_welcome_json(self):
         """
         There is a JSON version of the welcome page which can be selected with the