From 57c25dc3a04b026e86ac72c2ca01700e372906c9 Mon Sep 17 00:00:00 2001 From: Hamish Willee Date: Tue, 2 Mar 2021 12:11:50 +1100 Subject: [PATCH 1/4] HTTP Referer-Policy - new default value in spec --- .../http/headers/referrer-policy/index.html | 57 +++++++++---------- 1 file changed, 26 insertions(+), 31 deletions(-) diff --git a/files/en-us/web/http/headers/referrer-policy/index.html b/files/en-us/web/http/headers/referrer-policy/index.html index 2714f7705f9c8e7..bfaa54fac96bc19 100644 --- a/files/en-us/web/http/headers/referrer-policy/index.html +++ b/files/en-us/web/http/headers/referrer-policy/index.html @@ -13,7 +13,7 @@ ---
{{HTTPSidebar}}
-

The Referrer-Policy {{glossary("HTTP header")}} controls how much referrer information (sent via the {{HTTPHeader("Referer")}} header) should be included with requests. Aside from the HTTP header, you can set this policy in HTML.

+

The Referrer-Policy {{glossary("HTTP header")}} controls how much referrer information (sent via the {{HTTPHeader("Referer")}} header) should be included with requests. Aside from the HTTP header, you can set this policy in HTML.

@@ -30,10 +30,6 @@

Syntax

-
-

The original header name {{HTTPHeader("Referer")}} is a misspelling of the word "referrer". The Referrer-Policy header does not share this misspelling.

-
- 
Referrer-Policy: no-referrer
 Referrer-Policy: no-referrer-when-downgrade
 Referrer-Policy: origin
@@ -44,14 +40,18 @@ 
Syntax

 Referrer-Policy: unsafe-url
+
+

Note

+

The original header name {{HTTPHeader("Referer")}} is a misspelling of the word "referrer". The Referrer-Policy header does not share this misspelling.

+
+

Directives

no-referrer
The {{HTTPHeader("Referer")}} header will be omitted entirely. No referrer information is sent along with requests.
-
no-referrer-when-downgrade (default)
-
This is the default behavior if no policy is specified, or if the provided value is invalid. The {{glossary("origin")}}, path, and querystring of the URL are sent as a referrer when the protocol security level stays the same (HTTP→HTTP, HTTPS→HTTPS) or improves (HTTP→HTTPS), but isn't sent to less secure destinations (HTTPS→HTTP). -
There is effort from browsers in moving to a stricter default value, namely strict-origin-when-cross-origin (see https://github.com/whatwg/fetch/pull/952), consider using this value (or a stricter one), if possible, when changing the Referrer-Policy.
+
no-referrer-when-downgrade
+
The {{glossary("origin")}}, path, and querystring of the URL are sent as a referrer when the protocol security level stays the same (HTTP→HTTP, HTTPS→HTTPS) or improves (HTTP→HTTPS), but isn't sent to less secure destinations (HTTPS→HTTP).
origin
Only send the {{glossary("origin")}} of the document as the referrer.
@@ -62,12 +62,19 @@

Directives

A referrer will be sent for same-site origins, but cross-origin requests will send no referrer information.
strict-origin
Only send the origin of the document as the referrer when the protocol security level stays the same (HTTPS→HTTPS), but don't send it to a less secure destination (HTTPS→HTTP).
-
strict-origin-when-cross-origin
-
Send the origin, path, and querystring when performing a same-origin request, only send the origin when the protocol security level stays the same while performing a cross-origin request (HTTPS→HTTPS), and send no header to any less-secure destinations (HTTPS→HTTP).
+
strict-origin-when-cross-origin (default)
+
Send the origin, path, and querystring when performing a same-origin request, only send the origin when the protocol security level stays the same while performing a cross-origin request (HTTPS→HTTPS), and send no header to any less-secure destinations (HTTPS→HTTP). + +
+

Note

+

This is the default policy if no policy is specified, or if the provided value is invalid (see spec revision November 2020). Previously the default was no-referrer-when-downgrade.

+
+
unsafe-url
Send the origin, path, and query string when performing any request, regardless of security.
-

This policy will leak potentially-private information from HTTPS resource URLs to insecure origins. Carefully consider the impact of this setting.

+

Warning

+

This policy will leak potentially-private information from HTTPS resource URLs to insecure origins. Carefully consider the impact of this setting.

@@ -78,7 +85,7 @@

Integration with HTML

<meta name="referrer" content="origin">
-

Or set it for individual requests with the referrerpolicy attribute on {{HTMLElement("a")}}, {{HTMLElement("area")}}, {{HTMLElement("img")}}, {{HTMLElement("iframe")}}, {{HTMLElement("script")}}, or {{HTMLElement("link")}} elements:

+

Or set it for individual requests with the referrerpolicy attribute on {{HTMLElement("a")}}, {{HTMLElement("area")}}, {{HTMLElement("img")}}, {{HTMLElement("iframe")}}, {{HTMLElement("script")}}, or {{HTMLElement("link")}} elements:

<a href="http://example.com" referrerpolicy="origin">
@@ -87,7 +94,8 @@

Integration with HTML

<a href="http://example.com" rel="noreferrer">
-

As seen above, the noreferrer link relation is written without a dash — noreferrer. When the referrer policy is specified for the entire document with a {{HTMLElement("meta")}} element, it's written with a dash: <meta name="referrer" content="no-referrer">.

+

Warning

+

As seen above, the noreferrer link relation is written without a dash — noreferrer. When the referrer policy is specified for the entire document with a {{HTMLElement("meta")}} element, it's written with a dash: <meta name="referrer" content="no-referrer">.

Integration with CSS

@@ -95,8 +103,8 @@

Integration with CSS

CSS can fetch resources referenced from stylesheets. These resources follow a referrer policy as well:

Examples

@@ -232,25 +240,12 @@

Browser compatibility

{{Compat("http.headers.Referrer-Policy")}}

-
- - -

Possible values are:

- - -
-

See also

@@ -47,12 +46,15 @@

Directives

<url>
-
An absolute or partial address of the previous web page from which a link to the currently requested page was followed. URL fragments (i.e. "#section") and userinfo (i.e. "username:password" in "https://username:password@example.com/foo/bar/") are not included.
+
An absolute or partial address of the web page making the request. URL fragments (i.e. "#section") and userinfo (i.e. "username:password" in "https://username:password@example.com/foo/bar/") are not included. Origin, path, and querystring may be included, depending on the referrer policy.

Examples

-
Referer: https://developer.mozilla.org/en-US/docs/Web/JavaScript
+
Referer: https://developer.mozilla.org/en-US/docs/Web/JavaScript
+Referer: https://example.com/page?q=123
+Referer: https://example.com/
+

Specifications

@@ -80,6 +82,10 @@

Browser compatibility

See also

+
  • {{interwiki("wikipedia", "HTTP_referer", "HTTP referer on Wikipedia")}}
    • +
  • Fetch: {{domxref("Request.referrerPolicy")}}
    • +
  • The obsolete {{HTTPHeader("Content-Security-Policy")}} {{HTTPHeader("Content-Security-Policy/referrer", "referrer")}} {{Obsolete_Inline}} directive.
    • +
  • Same-origin policy
    • +
  • Tighter Control Over Your Referrers – Mozilla Security Blog
    • + + \ No newline at end of file diff --git a/files/en-us/web/http/headers/referrer-policy/index.html b/files/en-us/web/http/headers/referrer-policy/index.html index bfaa54fac96bc19..9e6f6b2cce583ea 100644 --- a/files/en-us/web/http/headers/referrer-policy/index.html +++ b/files/en-us/web/http/headers/referrer-policy/index.html @@ -243,8 +243,6 @@

    Browser compatibility

    See also