diff --git a/files/en-us/mozilla/firefox/releases/87/index.html b/files/en-us/mozilla/firefox/releases/87/index.html index 9a0bd3ff07f19fb..77bd48a31f1df89 100644 --- a/files/en-us/mozilla/firefox/releases/87/index.html +++ b/files/en-us/mozilla/firefox/releases/87/index.html @@ -58,8 +58,9 @@

Removals

HTTP

+

Removals

diff --git a/files/en-us/web/http/headers/referer/index.html b/files/en-us/web/http/headers/referer/index.html index 0efa52788f34558..59bf9fc4678bc6f 100644 --- a/files/en-us/web/http/headers/referer/index.html +++ b/files/en-us/web/http/headers/referer/index.html @@ -10,20 +10,19 @@ ---
{{HTTPSidebar}}
-

The Referer request header contains the address of the page making the request. When following a link, this would be the url of the page containing the link. When making AJAX requests to another domain, this would be your page's url. The Referer header allows servers to identify where people are visiting them from and may use that data for analytics, logging, or optimized caching, for example.

+

The Referer HTTP request header contains an absolute or partial address of the page making the request. When following a link, this would be the address of the page containing the link. When making resource requests to another domain, this would be the address of the page using the resource. The Referer header allows servers to identify where people are visiting them from, which can then be used for analytics, logging, optimized caching, and more.

-
-

Important: Although this header has many innocent uses it can have undesirable consequences for user security and privacy. See Referer header: privacy and security concerns for more information and mitigations.

-
- -

Note that referer is actually a misspelling of the word "referrer". See {{interwiki("wikipedia", "HTTP_referer", "HTTP referer on Wikipedia")}} for more details.

+

The Referer header may not contain URL fragments (i.e. "#section") or "username:password" information. It can potentially contain an origin, path, and querystring. What is sent, if anything, depends on the referrer policy for the request. See {{HTTPHeader("Referrer-Policy")}} for information and examples. -

A Referer header is not sent by browsers if:

+
+

Note

+

The header name "referer" is actually a misspelling of the word "referrer". See {{interwiki("wikipedia", "HTTP_referer", "HTTP referer on Wikipedia")}} for more details.

+
- +
+

Warning

+

Although this header has many innocent uses it can have undesirable consequences for user security and privacy. See Referer header: privacy and security concerns for more information and mitigations.

+
@@ -47,12 +46,15 @@

Directives

<url>
-
An absolute or partial address of the previous web page from which a link to the currently requested page was followed. URL fragments (i.e. "#section") and userinfo (i.e. "username:password" in "https://username:password@example.com/foo/bar/") are not included.
+
An absolute or partial address of the web page making the request. URL fragments (i.e. "#section") and userinfo (i.e. "username:password" in "https://username:password@example.com/foo/bar/") are not included. Origin, path, and querystring may be included, depending on the referrer policy.

Examples

-
Referer: https://developer.mozilla.org/en-US/docs/Web/JavaScript
+
Referer: https://developer.mozilla.org/en-US/docs/Web/JavaScript
+Referer: https://example.com/page?q=123
+Referer: https://example.com/
+

Specifications

@@ -80,6 +82,10 @@

Browser compatibility

See also

+
  • {{interwiki("wikipedia", "HTTP_referer", "HTTP referer on Wikipedia")}}
    • +
  • Fetch: {{domxref("Request.referrerPolicy")}}
    • +
  • The obsolete {{HTTPHeader("Content-Security-Policy")}} {{HTTPHeader("Content-Security-Policy/referrer", "referrer")}} {{Obsolete_Inline}} directive.
    • +
  • Same-origin policy
    • +
  • Tighter Control Over Your Referrers – Mozilla Security Blog
    • + + \ No newline at end of file diff --git a/files/en-us/web/http/headers/referrer-policy/index.html b/files/en-us/web/http/headers/referrer-policy/index.html index 2714f7705f9c8e7..a6ea5f5ee4e9908 100644 --- a/files/en-us/web/http/headers/referrer-policy/index.html +++ b/files/en-us/web/http/headers/referrer-policy/index.html @@ -13,7 +13,7 @@ ---
    {{HTTPSidebar}}
    -

    The Referrer-Policy {{glossary("HTTP header")}} controls how much referrer information (sent via the {{HTTPHeader("Referer")}} header) should be included with requests. Aside from the HTTP header, you can set this policy in HTML.

    +

    The Referrer-Policy {{glossary("HTTP header")}} controls how much referrer information (sent via the {{HTTPHeader("Referer")}} header) should be included with requests. Aside from the HTTP header, you can set this policy in HTML.

    @@ -30,10 +30,6 @@

    Syntax

    -
    -

    The original header name {{HTTPHeader("Referer")}} is a misspelling of the word "referrer". The Referrer-Policy header does not share this misspelling.

    -
    - 
    Referrer-Policy: no-referrer
 Referrer-Policy: no-referrer-when-downgrade
 Referrer-Policy: origin
@@ -44,30 +40,41 @@ 
    Syntax
    
 Referrer-Policy: unsafe-url
    +
    +

    Note

    +

    The original header name {{HTTPHeader("Referer")}} is a misspelling of the word "referrer". The Referrer-Policy header does not share this misspelling.

    +
    +

    Directives

    no-referrer
    The {{HTTPHeader("Referer")}} header will be omitted entirely. No referrer information is sent along with requests.
    -
    no-referrer-when-downgrade (default)
    -
    This is the default behavior if no policy is specified, or if the provided value is invalid. The {{glossary("origin")}}, path, and querystring of the URL are sent as a referrer when the protocol security level stays the same (HTTP→HTTP, HTTPS→HTTPS) or improves (HTTP→HTTPS), but isn't sent to less secure destinations (HTTPS→HTTP). -
    There is effort from browsers in moving to a stricter default value, namely strict-origin-when-cross-origin (see https://github.com/whatwg/fetch/pull/952), consider using this value (or a stricter one), if possible, when changing the Referrer-Policy.
    +
    no-referrer-when-downgrade
    +
    Send the {{glossary("origin")}}, path, and querystring in {{HTTPHeader("Referer")}} when the protocol security level stays the same or improves (HTTP→HTTP, HTTP→HTTPS, HTTPS→HTTPS. Don't send the {{HTTPHeader("Referer")}} header for requests to less secure destinations (HTTPS→HTTP, HTTPS→file).
    origin
    -
    Only send the {{glossary("origin")}} of the document as the referrer.
    +
    Send the {{glossary("origin")}} (only) in the {{HTTPHeader("Referer")}} header.
    For example, a document at https://example.com/page.html will send the referrer https://example.com/.
    origin-when-cross-origin
    -
    Send the {{glossary("origin")}}, path, and query string when performing a {{glossary("Same-origin_policy", "same-origin")}} request, but only send the origin of the document for other cases.
    +
    Send the {{glossary("origin")}}, path, and query string when performing a {{glossary("Same-origin_policy", "same-origin")}} request to the same protocol level. Send origin (only) for cross origin requests and requests to less secure destinations.
    same-origin
    -
    A referrer will be sent for same-site origins, but cross-origin requests will send no referrer information.
    +
    Send the {{glossary("origin")}}, path, and query string for {{glossary("Same-origin_policy", "same-origin")}} requests. Don't send the {{HTTPHeader("Referer")}} header for cross-origin requests.
    strict-origin
    -
    Only send the origin of the document as the referrer when the protocol security level stays the same (HTTPS→HTTPS), but don't send it to a less secure destination (HTTPS→HTTP).
    -
    strict-origin-when-cross-origin
    -
    Send the origin, path, and querystring when performing a same-origin request, only send the origin when the protocol security level stays the same while performing a cross-origin request (HTTPS→HTTPS), and send no header to any less-secure destinations (HTTPS→HTTP).
    +
    Send the origin (only) when the protocol security level stays the same (HTTPS→HTTPS). Don't send the {{HTTPHeader("Referer")}} header to less secure destinations (HTTPS→HTTP).
    +
    strict-origin-when-cross-origin (default)
    +
    Send the origin, path, and querystring when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS). Don't send the {{HTTPHeader("Referer")}} header to less secure destinations (HTTPS→HTTP). + +
    +

    Note

    +

    This is the default policy if no policy is specified, or if the provided value is invalid (see spec revision November 2020). Previously the default was no-referrer-when-downgrade.

    +
    +
    unsafe-url
    Send the origin, path, and query string when performing any request, regardless of security.
    -

    This policy will leak potentially-private information from HTTPS resource URLs to insecure origins. Carefully consider the impact of this setting.

    +

    Warning

    +

    This policy will leak potentially-private information from HTTPS resource URLs to insecure origins. Carefully consider the impact of this setting.

    @@ -78,7 +85,7 @@

    Integration with HTML

    <meta name="referrer" content="origin">
    -

    Or set it for individual requests with the referrerpolicy attribute on {{HTMLElement("a")}}, {{HTMLElement("area")}}, {{HTMLElement("img")}}, {{HTMLElement("iframe")}}, {{HTMLElement("script")}}, or {{HTMLElement("link")}} elements:

    +

    Or set it for individual requests with the referrerpolicy attribute on {{HTMLElement("a")}}, {{HTMLElement("area")}}, {{HTMLElement("img")}}, {{HTMLElement("iframe")}}, {{HTMLElement("script")}}, or {{HTMLElement("link")}} elements:

    <a href="http://example.com" referrerpolicy="origin">
    @@ -87,7 +94,8 @@

    Integration with HTML

    <a href="http://example.com" rel="noreferrer">
    -

    As seen above, the noreferrer link relation is written without a dash — noreferrer. When the referrer policy is specified for the entire document with a {{HTMLElement("meta")}} element, it's written with a dash: <meta name="referrer" content="no-referrer">.

    +

    Warning

    +

    As seen above, the noreferrer link relation is written without a dash — noreferrer. When the referrer policy is specified for the entire document with a {{HTMLElement("meta")}} element, it's written with a dash: <meta name="referrer" content="no-referrer">.

    Integration with CSS

    @@ -95,8 +103,8 @@

    Integration with CSS

    CSS can fetch resources referenced from stylesheets. These resources follow a referrer policy as well:

    Examples

    @@ -232,25 +240,10 @@

    Browser compatibility

    {{Compat("http.headers.Referrer-Policy")}}

    -
    - - -

    Possible values are:

    - - -
    -

    See also