HTTP Security Headers

Referrer-Policy

Controls how much of the current URL leaks to other sites in the Referer header when users click links or the page loads cross-origin resources.

What it is

When a browser makes a request, it may include a Referer header naming the page the request came from. That URL can leak sensitive data — session tokens in query strings, internal path structure, or simply which page a user was on. Referrer-Policy lets the site control exactly how much of that URL is sent, and to whom.

Values

no-referrer
Never send the Referer header at all.
same-origin
Send the full URL only to same-origin requests; nothing cross-origin.
strict-origin
Send only the origin, and only when the protocol security level stays the same (HTTPS→HTTPS).
strict-origin-when-cross-origin
Full URL to same-origin; origin only to cross-origin; nothing on HTTPS→HTTP downgrade. The modern browser default.
no-referrer-when-downgrade
Legacy default: full URL except on a secure→insecure downgrade.
unsafe-url
Always send the full URL, even cross-origin and on downgrade. Avoid — leaks path and query everywhere.
HTTP RESPONSE HEADER
Referrer-Policy: strict-origin-when-cross-origin

Why it matters

  • It prevents secrets embedded in URLs (reset tokens, session ids) from leaking to third parties through the Referer header.
  • It reduces the internal URL structure you expose to external analytics, ad networks and linked sites.
  • Setting it explicitly protects you even in browsers whose default differs from the modern strict-origin-when-cross-origin.

Common mistakes

  • Using unsafe-url, which broadcasts the full path and query to every destination — a real data-leak risk.
  • Assuming the browser default is safe everywhere; older browsers used no-referrer-when-downgrade, which leaks full URLs cross-origin.
  • Putting tokens in query strings at all — a strict Referrer-Policy mitigates but does not fully excuse this.

How WebInspect checks this

  • WebInspect reports the Referrer-Policy value and flags overly permissive settings such as unsafe-url.
  • It notes when the header is missing, so the site is relying on a browser default that may leak more than intended.
  • It recommends strict-origin-when-cross-origin (or stricter) as the safe baseline.