-
Notifications
You must be signed in to change notification settings - Fork 0
Description
Short description of the enhancement
Please add a meta referrer tag to the core admin themes to ensure no referrer information is sent for external links. This is for security reasons (prevent the admin login url from being disclosed to a third party) and also for general privacy reasons.
The tag could be
<meta name="referrer" content="no-referrer">
or
<meta name="referrer" content="same-origin">
The external links I've seen in the admin that are coming from core code already have "no-referrer" set in the rel
attribute which is great, but module developers may not follow this practice, and if a link is included in a field description using markdown I don't think there is any way to set the rel
attribute.
Having referrers off globally in the admin for external links will mean module developers and users don't need to think about it (although they will still have the ability to override the referrer policy for specific links if needed).