Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use Referrer Policy to prevent referrers from being sent #6147

Closed
rugk opened this issue Feb 15, 2018 · 3 comments · Fixed by #6155
Closed

Use Referrer Policy to prevent referrers from being sent #6147

rugk opened this issue Feb 15, 2018 · 3 comments · Fixed by #6155
Labels
Help Wanted Extra attention is needed P3 T-Enhancement

Comments

@rugk
Copy link
Contributor

rugk commented Feb 15, 2018

I did not check whether you already use a similar mechanism, but it would be great if you can prevent the browser from sending the referrer when they click on a link (a user sent), so it does not leak to the site that the user came from Riot (including the whole URL).

The fix is easy, it's also just another HTTP header or HTML meta tag. So even if you already prevent it in some other way, this is a really safe and small thing and works in all modern browsers, so you should really make use of that.
@rugk rugk mentioned this issue Feb 15, 2018
Merged
@rugk
Copy link
Contributor Author

rugk commented Feb 15, 2018

BTW you can also add rel="noreferrer" to links, but one referrer policy works for all links, so…

@lampholder lampholder added feature P3 Help Wanted Extra attention is needed labels Feb 15, 2018
@lampholder
Copy link
Member

Seems like a reasonable ask, and sounds easy to do.

P3 == a sensible feature that isn't on the team's roadmap right now, but we'd be happy to see it from a community contribution :)

@rugk
Copy link
Contributor Author

rugk commented Feb 15, 2018

If you look some centimeters/pixels above, I've already opened a PR… 😄

eras added a commit to eras/matrix-react-sdk that referenced this issue Oct 20, 2019
@eras
Set the noreferrer attribute to links and images
abd24a9 
An alternative fix to element-hq/element-web#6147 which for some reason
the PR element-hq/element-web#6155 is not yet merged.

The key difference is that the riot-web PR element-hq/element-web#6155
uses HTML meta header for noreferrer, while this one adds the
rel-attribute to include the noreferrer keyword in both user-created
links as well as links converted from incoming events.

I guess it's up to the maintainers then to pick and choose, but please
do ;).
@eras eras mentioned this issue Oct 20, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Help Wanted Extra attention is needed P3 T-Enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Prevent referrers from being sent
3 participants
@jryans @lampholder @rugk