Referrer-Policy
Referrer-Policy is an HTTP response header, specified by the W3C's Referrer Policy standard, that controls how much of the current page's URL a browser includes in the Referer header of requests it triggers to other origins -- loading an image, following a link, or submitting a form. Defined values range from no-referrer, which omits the header entirely, through origin, which sends only the scheme, host and port, to same-origin, which sends the full URL only to the page's own origin. Modern browsers default to strict-origin-when-cross-origin when no header is set: it sends the full URL to same-origin destinations, only the origin across origins, and nothing at all when a request would downgrade from HTTPS to plain HTTP. Without an explicit, stricter policy, a page's own URLs -- which can carry session tokens or search terms in the path or query string -- may leak to every third-party resource it loads.
By AdminKit team, Netbase JSC · Updated