httphttpsreferrerhttp-refererreferrer-policy

Is the origin sent in the referer header when the current document establishes a "strict-origin" policy and the protocol level improves?


I would like to know if the origin of the current document is sent in the referer header when it establishes a "strict-origin" policy and the protocol level improves.

For examples:
The current document is http://example.com/index.html, it sets a referer policy of "strict-origin", then some requests are made to https://anotherexample.com/script.js.

I would like to know what will be the value of the referer in this particular case (note that the protocol level improves).

Regarding the documentation (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy#strict-origin_2), it is not clear: strict-origin referrer policy regarding the documentation

Thanks for your help,

Bests


Solution

  • Looking at the spec, it seems referrer is always sent when referrerURL is non-trustworthy. So I believe the request would contain the referrer info.

    The algo states:

    Execute the statements corresponding to the value of policy:
    Note: If request’s referrer policy is the empty string, Fetch will not call into this algorithm.

    "strict-origin"

    1. If referrerURL is a potentially trustworthy URL and request’s current URL is not a potentially trustworthy URL, then return no referrer.

    2. Return referrerOrigin.

    strict-origin-when-cross-origin means treating as strict origin when the requests are cross origin. And since this is cross origin (HTTP to HTTPS), behaviour should be same as strict origin. This means ASCII serialization of referrer should be sent.