-
Notifications
You must be signed in to change notification settings - Fork 22.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
HTTP Referrer-Policy - new default value in spec (#2792)
* HTTP Referer-Policy - new default value in spec * HTTP Referer header - better links to policy * Referer security concerns: minor subedit * Add release notes, improve directives
- Loading branch information
1 parent
1277254
commit 297b6e6
Showing
4 changed files
with
57 additions
and
57 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,20 +10,19 @@ | |
| --- | ||
| <div>{{HTTPSidebar}}</div> | ||
|
|
||
| <p>The <code><strong>Referer</strong></code> request header contains the address of the page making the request. When following a link, this would be the url of the page containing the link. When making AJAX requests to another domain, this would be your page's url. The <code>Referer</code> header allows servers to identify where people are visiting them from and may use that data for analytics, logging, or optimized caching, for example.</p> | ||
| <p>The <code><strong>Referer</strong></code> HTTP request header contains an absolute or partial address of the page making the request. When following a link, this would be the address of the page containing the link. When making resource requests to another domain, this would be the address of the page using the resource. The <code>Referer</code> header allows servers to identify where people are visiting them from, which can then be used for analytics, logging, optimized caching, and more.</p> | ||
|
|
||
| <div class="warning"> | ||
| <p><strong>Important</strong>: Although this header has many innocent uses it can have undesirable consequences for user security and privacy. See <a href="/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns">Referer header: privacy and security concerns</a> for more information and mitigations.</p> | ||
| </div> | ||
|
|
||
| <p>Note that referer is actually a misspelling of the word "referrer". See {{interwiki("wikipedia", "HTTP_referer", "HTTP referer on Wikipedia")}} for more details.</p> | ||
| <p>The <code>Referer</code> header may not contain URL fragments (i.e. "#section") or "username:password" information. It can potentially contain an <em>origin</em>, <em>path</em>, and <em>querystring</em>. What is sent, if anything, depends on the <em>referrer policy</em> for the request. See {{HTTPHeader("Referrer-Policy")}} for <a href="/en-US/docs/Web/HTTP/Headers/Referrer-Policy#directives">information</a> and <a href="/en-US/docs/Web/HTTP/Headers/Referrer-Policy#examples">examples</a>. | ||
|
|
||
| <p>A <code>Referer</code> header is not sent by browsers if:</p> | ||
| <div class="notecard note"> | ||
| <h4>Note</h4> | ||
| <p>The header name "referer" is actually a misspelling of the word "referrer". See {{interwiki("wikipedia", "HTTP_referer", "HTTP referer on Wikipedia")}} for more details.</p> | ||
| </div> | ||
|
|
||
| <ul> | ||
| <li>The referring resource is a local "file" or "data" URI.</li> | ||
| <li>An unsecured HTTP request is used and the referring page was received with a secure protocol (HTTPS).</li> | ||
| </ul> | ||
| <div class="notecard warning"> | ||
| <h4>Warning</h4> | ||
| <p>Although this header has many innocent uses it can have undesirable consequences for user security and privacy. See <a href="/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns">Referer header: privacy and security concerns</a> for more information and mitigations.</p> | ||
| </div> | ||
|
|
||
| <table class="properties"> | ||
| <tbody> | ||
|
|
@@ -47,12 +46,15 @@ <h2 id="Directives">Directives</h2> | |
|
|
||
| <dl> | ||
| <dt><url></dt> | ||
| <dd>An absolute or partial address of the previous web page from which a link to the currently requested page was followed. URL fragments (i.e. "#section") and userinfo (i.e. "username:password" in "https://username:[email protected]/foo/bar/") are not included.</dd> | ||
| <dd>An absolute or partial address of the web page making the request. URL fragments (i.e. "#section") and userinfo (i.e. "username:password" in "https://username:[email protected]/foo/bar/") are not included. Origin, path, and querystring may be included, depending on the <a href="/en-US/docs/Web/HTTP/Headers/Referrer-Policy#directives">referrer policy</a>.</dd> | ||
| </dl> | ||
|
|
||
| <h2 id="Examples">Examples</h2> | ||
|
|
||
| <pre>Referer: https://developer.mozilla.org/en-US/docs/Web/JavaScript</pre> | ||
| <pre>Referer: https://developer.mozilla.org/en-US/docs/Web/JavaScript | ||
| Referer: https://example.com/page?q=123 | ||
| Referer: https://example.com/ | ||
| </pre> | ||
|
|
||
| <h2 id="Specifications">Specifications</h2> | ||
|
|
||
|
|
@@ -80,6 +82,10 @@ <h2 id="Browser_compatibility">Browser compatibility</h2> | |
| <h2 id="See_also">See also</h2> | ||
|
|
||
| <ul> | ||
| <li>{{interwiki("wikipedia", "HTTP_referer", "HTTP referer on Wikipedia")}}</li> | ||
| <li>{{HTTPHeader("Referrer-Policy")}}</li> | ||
| </ul> | ||
| <li>{{interwiki("wikipedia", "HTTP_referer", "HTTP referer on Wikipedia")}}</li> | ||
| <li><a href="/en-US/docs/Web/API/Fetch_API">Fetch</a>: {{domxref("Request.referrerPolicy")}}</li> | ||
| <li>The obsolete {{HTTPHeader("Content-Security-Policy")}} {{HTTPHeader("Content-Security-Policy/referrer", "referrer")}} {{Obsolete_Inline}} directive.</li> | ||
| <li><a href="/en-US/docs/Web/Security/Same-origin_policy">Same-origin policy</a></li> | ||
| <li><a href="https://blog.mozilla.org/security/2015/01/21/meta-referrer/">Tighter Control Over Your Referrers – Mozilla Security Blog</a></li> | ||
| </ul> | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.