Ref T4340. Some browsers respect this header and referrers are a plague upon the earth.
Also, upgrade "never" to the more modern value "no-referrer".
Details
Details
- Reviewers
- None
- Maniphest Tasks
- T4340: Implement Content-Security-Policy and Strict-Transport-Security headers
- Commits
- rP9658249ac5a0: Add "Referrer-Policy: no-referrer" to standard HTTP headers
In Safari, Firefox and Chrome, disabled rel="noreferrer" on links and generated a normal link to an external site. Then clicked it and checked if a referrer was sent.
- Safari respects meta only, but "no-referrer" is fine.
- Firefox respects both (either the header or meta tag are individually sufficient to stop referrers).
- Chrome respects both (same as Firefox).
Diff Detail
Diff Detail
- Repository
- rP Phabricator
- Lint
Lint Not Applicable - Unit
Tests Not Applicable