fix: set Referrer-Policy header to strict-origin-when-cross-origin

wKovacs64 · Apr 24, 2022 · 86c037c · 86c037c
1 parent 9a0a387
commit 86c037c
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/netlify.toml b/netlify.toml
@@ -10,7 +10,7 @@
     X-XSS-Protection = "1; mode=block"
     Content-Security-Policy = "default-src 'self'; connect-src 'self' https://api.pwnedpasswords.com; img-src data: https:; script-src 'self' 'unsafe-inline'; style-src 'self'; worker-src 'self'; object-src 'none'"
     Permissions-Policy = "geolocation=(), camera=(), microphone=(), payment=(), usb=()"
-    Referrer-Policy = "no-referrer-when-downgrade"
+    Referrer-Policy = "strict-origin-when-cross-origin"
     Expect-CT = "enforce, max-age=3600"
 
 [[headers]]