Firefox and Safari now ignore "unsafe" referrer-policies

[benediktwerner]

Summary

Recent versions of Firefox and Safari ignore "unsafe" referer-policies like "unsafe-url".

Test results and supporting details

• Firefox bug about the removal: https://bugzilla.mozilla.org/show_bug.cgi?id=1720294
• Experimentally, it seems that Safari is ignoring them since version 13
• Here's a test page: https://home.in.tum.de/~wernerbe/firefox-referrer-bug.html?a=b
  • When the corresponding header is supported, the first two iframes should include the full referrer (including path and query params) in the output, and clicking the link should show the origin instead of None

[queengooborg]

Hey there, thank you for your PR, and welcome to BCD! Apologies for the long delay in reviewing your PR, this one ended up getting buried in the other PRs we've had opened.

Just a quick question: where did you get the "13" for Safari from?

[benediktwerner]

Can't remember for certain anymore but I'm pretty sure I just tried it on different versions in browserstack.

Searching a bit more, it seems like caniuse actually also mentions it, citing https://webkit.org/blog/9661/preventing-tracking-prevention-tracking/ as the source which indicates 13.3 on iOS and 13.0.4 on Macs as the exact versions where it started getting ignored. I'll update the numbers.

[queengooborg]

I trust CanIUse data, thanks for confirming!

[benediktwerner]

Updated the iOS version to 13.3, not sure whether it's desired to desired to use 13.0.4 for Desktop or whether that's unnecessarily precise, looks like caniuse also just lists it as "13" (and 13.3 for iOS).

[queengooborg]

"13" is perfect (see https://github.com/mdn/browser-compat-data/blob/main/docs/data-guidelines/index.md#choosing-a-version-number for the full explanation) -- I'll take another look at your PR tomorrow!

[benediktwerner]

Hm, I guess the linter didn't like 13.3 for iOS. It seems correct though, the guidelines you posted say it should be the iOS version and iOS 13.3 definitely existed. Should I add it as a possible version or just revert it to "13"? Also feel free to directly modify my PR.

[queengooborg]

Let's go ahead and revert Safari iOS to "13"; although technically this is partially incorrect, I don't think many BCD consumers will worry about minor versions from browser releases over three years old. ;P

[benediktwerner]

True, done. (the commit date somehow got messed up so GitHub shows the commit further up ...)

[Elchi3]

Looks like this got never merged ooops

[Elchi3]

Thank you and sorry for the incredible long wait.