Potential for reset password link with token to leak to third-parties via the Referer header

[summera]

I searched to see if this had been brought up before and couldn't find any open or closed issue or PR that mentioned it. If there is one and I missed it, please let me know.

As discussed in this thoughtbot article the reset password link with the token can be leaked to third-parties (CDN, analytics, links to other third-party domains from your site) via the Referer header which is sent by the browser with all requests from the current page (edit password in this case). To fix this in our app I've done something similar to what they did to solve this in Clearance by temporarily storing the reset password token in the session and redirecting the user back to the password edit page without the reset password token in the url params. The token is then pulled from the session to be used in the form.

I'm wondering if this is something you'd be interested in fixing in Devise and if so I'd be happy to put in a PR.

[tegon]

There's a discussion about this in this PR: #4366

[sonalkr132]

Rails started setting Referrer-Policy to strict-origin-when-cross-origin since 5.2 rails/rails@428939b

[tegon]

I didn't know about that @sonalkr132, thanks for sharing!

I'm more inclined to use the Referrer-Policy header to solve this instead of having to change a bunch of code to try to mitigate this at our side.
Looking at https://caniuse.com/#feat=referrer-policy it seems like the bigger issue with support is on Edge and Safari on iOS. They do support an older draft, though. Setting never or origin in an HTML meta element should do the trick, right?

[antonlitvinenko]

The Referrer-Policy looks like almost a solution... but we found that it might be not enough.
For example, we use intercom widget on our pages to provide customer support and even with the Referrer-Policy set to strict-origin-when-cross-origin they leak the full request url:

Which means that there actually has to be a stronger way to enforce this. In my opinion, the session idea from Clearance sounds nice.