Glossary / Referrer-Policy

Referrer-Policy

Referrer-Policy is an HTTP header that controls how much information about the current page the browser puts in the Referer header when the user follows a link or the page loads a resource. It lets you avoid leaking full URLs with private parameters to third-party sites.

When a user clicks a link or the page loads an external resource, by default the browser adds a Referer header saying which page the request came from. That can include the full URL with tokens, ids or search queries you would rather not hand to someone else's server.

Referrer-Policy sets the trimming rule. no-referrer drops the header entirely. strict-origin sends only the domain, no path. The popular strict-origin-when-cross-origin sends the full URL to your own pages, only the domain to other sites, and nothing when going from HTTPS to HTTP.

The header affects both privacy and analytics. Too strict and you lose traffic-source data in your own stats; too open and you leak addresses to third parties. strict-origin-when-cross-origin is a sensible default balance.

Example

Referrer-Policy: strict-origin-when-cross-origin

Common mistakes

• Setting no-referrer for privacy and then losing referral sources in your own analytics, which also rely on Referer.
• Mixing up Referer (the request header the browser sends) with Referrer-Policy (the response header that controls it).
• Trusting Referer for authorization. It is trivial to forge or strip, so it is useless for security.
• Leaving the default policy and leaking full URLs with private parameters to third-party domains through their scripts.

Related terms

• HSTS (Strict-Transport-Security) HSTS (Strict-Transport-Security)
• Content-Security-Policy (CSP) Content-Security-Policy (CSP)
• X-Frame-Options X-Frame-Options
• X-Content-Type-Options X-Content-Type-Options
• Permissions-Policy Permissions-Policy