Referrer-Policy

Referrer-Policy is an HTTP header that sets how much referrer information the browser sends in the Referer request header when a user follows a link or a page loads an image, script or API call. The header name is spelled correctly, while the request header it controls keeps the historic misspelling.

Why it matters

Full URLs can contain sensitive details such as search terms, document identifiers or tokens in query strings. Sending them to every third party leaks that data and helps tracking. A stricter policy limits what is shared while still giving analytics enough to work, for example only the origin.

Example

Referrer-Policy: strict-origin-when-cross-origin

On the same site the full path is sent. To another site, only the origin such as https://example.com/ is sent, and nothing is sent when moving from HTTPS to HTTP. Browsers commonly default to this value now. Other values include no-referrer and same-origin.

Common mistakes

• Using no-referrer and then losing legitimate analytics or partner attribution.
• Putting secrets in URLs and relying on the policy to hide them.
• Setting unsafe-url, which sends full URLs everywhere.
• Forgetting that link attributes can override the page policy.

Related

• Referrer
• Security headers
• Query string
• Permissions-Policy
• टूल: Security headers checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.