Agent WranglersAPS-31Recommended
Share less in the Referer header
Keep Referrer-Policy at the browser default, strict-origin-when-cross-origin, or stricter. Send it on every response, so no framework default, meta tag or old browser loosens it.
How to do it
Current browsers already default to strict-origin-when-cross-origin, so the header mostly guards against looser settings. A framework, a CMS plugin or a <meta name="referrer"> tag can set unsafe-url or no-referrer-when-downgrade, which send full addresses to other sites. Use same-origin or no-referrer on pages whose addresses carry tokens. Keep private data out of addresses in the first place, as Keep private data out of logs and addresses says.
Examples
HTTP example
Referrer-Policy: strict-origin-when-cross-originHow to check
curl -sI on a page and an error page shows strict-origin-when-cross-origin, same-origin or no-referrer. A search of the built pages finds no referrerpolicy attribute or <meta name="referrer"> with unsafe-url, no-referrer-when-downgrade, origin or origin-when-cross-origin.
Sources
Related rules
- APS-79 Keep private data out of logs and addresses in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/referrer-policy">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.