Skip to content

Add meta tag to admin themes to prevent referrer on external links #172

@Toutouwai

Description

@Toutouwai

Short description of the enhancement

Please add a meta referrer tag to the core admin themes to ensure no referrer information is sent for external links. This is for security reasons (prevent the admin login url from being disclosed to a third party) and also for general privacy reasons.

The tag could be
<meta name="referrer" content="no-referrer">
or
<meta name="referrer" content="same-origin">

The external links I've seen in the admin that are coming from core code already have "no-referrer" set in the rel attribute which is great, but module developers may not follow this practice, and if a link is included in a field description using markdown I don't think there is any way to set the rel attribute.

Having referrers off globally in the admin for external links will mean module developers and users don't need to think about it (although they will still have the ability to override the referrer policy for specific links if needed).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions