VibeSecurity

Data and privacy

What is Referrer-Policy?

Referrer-Policy is an HTTP header that controls how much of the current page's address the browser shares, in the Referer header, when a visitor follows a link or the page loads a resource from another site.

When someone clicks a link on your page, or your page loads an image or script from elsewhere, the browser tells the other site where the request came from. That matters when your URLs contain something private, such as a password reset token, an invite code, a search term or an internal document id. The full address can end up in another company's logs and analytics.

Modern browsers default to strict-origin-when-cross-origin, which sends the full address only to your own site, sends just the domain to other sites, and sends nothing when moving from HTTPS to HTTP. That default is sensible, but older browsers behave differently and some templates set the far looser unsafe-url value, so it is worth stating the policy yourself.

Set strict-origin-when-cross-origin for the whole site, or no-referrer if you want to share nothing at all. More importantly, keep secrets out of URLs where you can, because the address is also stored in browser history and server logs, which this header does not affect.

Share only the domain with other sites
Referrer-Policy: strict-origin-when-cross-origin

Go deeper

Related terms

Sources

  1. 1.MDN: Referrer-Policy
  2. 2.W3C: Referrer Policy