Ref T4340. Some browsers respect this header and referrers are a plague upon the earth.
Also, upgrade "never" to the more modern value "no-referrer".
Details
Details
- Reviewers
- None
- Maniphest Tasks
- T4340: Implement Content-Security-Policy and Strict-Transport-Security headers
- Commits
- rP9658249ac5a0: Add "Referrer-Policy: no-referrer" to standard HTTP headers
In Safari, Firefox and Chrome, disabled rel="noreferrer" on links and generated a normal link to an external site. Then clicked it and checked if a referrer was sent.
- Safari respects meta only, but "no-referrer" is fine.
- Firefox respects both (either the header or meta tag are individually sufficient to stop referrers).
- Chrome respects both (same as Firefox).
Diff Detail
Diff Detail
- Repository
- rP Phabricator
- Branch
- referrer1
- Lint
Lint Passed - Unit
Tests Passed - Build Status
Buildable 19676 Build 26644: Run Core Tests Build 26643: arc lint + arc unit