Allow setting referrer policy in speculation rules

[domenic]

We currently do not allow using a prerender or prefetch that has a mismatched referrer policy.

And, we always prerender or prefetch using the page's overall default referrer policy.

This means that if a site has something like this:

<script type=speculationrules>
{
  "prerender": [{
    "source": "list",
    "urls": ["page.html"]
  }]
}
</script>
<a rel="noreferrer" href="page.html">click me</a>

then the prerender will be discarded instead of activated. This is correct behavior, but is unfortunate.

We could solve this with document rules. Or, we could allow setting the expected referrer policy in the list rules, e.g.

{
  "prerender": [{
    "source": "list",
    "urls": ["page.html"],
    "referrer_policy": "no-referrer"
  }]
}

[domenic]

An alternative was discussed in #18, which is removing the requirement of referrer policy matching. There, we decided the reason we kept it was mostly to help in some cross-site cases related to cookies. I wonder if we should consider revisiting that decision, at least for same-site cases?

In particular, @domfarolino's survey in #18 (comment) of how nothing else keys on referrer policy is pretty convincing...

[domenic]

An alternative was discussed in #18, which is removing the requirement of referrer policy matching.

This is not a full alternative, however. Consider a site which does want to vary its content based on referrer. That site sends Vary: referer. Then, we really should require referrer matching.

For such sites, we need a way to indicate the referrer policy at prerendering time anyway. So, I think I am back to adding "referrer_policy" in the list rules.

[jeremyroman]

Agreed we want syntax for it at least for list rules; in my mind that was always going to happen, just a question of priority. Failing that we should respect the attribute on the link (for document rules) and the document's default referrer policy.

I need to give it more thought, but I think I'm coming around on not keying on referrer policy at least if Vary: Referer isn't present. The arguments about how caches work are at least somewhat convincing, and we'd already previously talked about enforcing a minimum referrer policy.

[toyoshim]

@domenic @jeremyroman hi, how is the status on this change? is there a specific blocker. or just isn't a high-priority item?
For a supportive input, I'm seeing a case that a major site hits this problem when I enforce the site to use prerendering.

[kjmcnee]

Implementation-wise I have a WIP CL here: https://chromium-review.googlesource.com/c/chromium/src/+/3971707 , which is almost ready for review.

[kjmcnee]

We've now spec'd the "referrer_policy" key in speculation rules. I'll go ahead and close this.