Referrer policy and Ping-From/Ping-To headers

[annevk]

HTML defines these two headers and says at least Ping-From is subject to the same rules as Referer in a somewhat roundabout way. Presumably at some point we want to define this accurately, but that would mean that the Referrer standard needs to provide some hooks.

[mikewest]

Makes sense that we'd tie these together: throwing this at @jeisinger.

[jeisinger]

do you mean that the Ping-From should respect the referrer policy or that the ping spec should state which referrer policy should be applied (probably default)?

[annevk]

I think it should respect the policy, otherwise ping would leak data href wouldn't. It seems easiest if the ping specification could invoke some hook in the Referrer Policy to determine what the header value should be, but I'm open to alternative setups.

[jeisinger]

yeah, unless the policy is always and previously, ping-from would have been empty. But that sounds unlikely.

[annevk]

(The current specification for ping already limits the value in various ways based what happens to referrer. That's why this came up. E.g., not sending Ping-From for downgrades.)

[jeisinger]

@estark37