Deprecate CSP referrer #196

elrido · 2017-03-12T13:25:58Z

Firefox 52 displays the following message in the console:

Content Security Policy: Referrer Directive "no-referrer" has been deprecated. Please use the Referrer-Policy header instead.

Reproduced in PrivateBin 1.1 and the current master branch.

rugk · 2017-03-12T14:27:58Z

Yeah, but we already use Referrer-Policy. And no-referrer might still be required for older browsers. Maybe at some time we can drop using it.

Salokyn · 2019-05-20T07:48:29Z

Yeah, but we already use Referrer-Policy.

I can't find where the header Referrer-Policy is set (I mean outside CSP where it should not remain eventually) ?

rugk · 2019-05-20T09:22:59Z

It's actually used as a HTML tag, not as a header. (Browsers allow both, however.)

Line 13 in fcf9cf6

Salokyn · 2019-05-20T12:08:22Z

Thank you.
Sorry I think my comment reopened the issue 😓

rugk · 2019-05-20T15:01:14Z

No, it's all fine. This issue has been open all the time anyway…

elrido added discuss me enhancement labels Mar 12, 2017

elrido added this to the Release 1.2 - JavaScript refactoring and unit testing milestone Mar 12, 2017

elrido modified the milestones: Release 1.4 - improved UI, Release 1.2 - JavaScript refactoring and unit testing Mar 13, 2017

rugk changed the title ~~CSP referrer deprecated?~~ Depreciate CSP referrer Dec 14, 2017

rugk added bug and removed discuss me enhancement labels Dec 14, 2017

rugk mentioned this issue Dec 14, 2017

Unrecognized Content-Security-Policy directive 'referrer'. #262

Closed

elrido changed the title ~~Depreciate CSP referrer~~ Deprecate CSP referrer Dec 15, 2017

rugk mentioned this issue Feb 12, 2018

Errors with CSP #281

Closed

elrido modified the milestones: Release 1.4 - improved UI, Release 1.3 - Review & refactor paste format Jun 15, 2019

elrido closed this as completed in 11375a4 Jun 27, 2019

Provide feedback