search

w3c / webappsec-referrer-policy

WebAppSec Referrer Policy
https://w3c.github.io/webappsec-referrer-policy/
Other
26 stars 27 forks source link

Question in relation to Referrer-Policy header and its relation with link rel attribute #159

Closed evilaliv3 closed 3 years ago

evilaliv3 commented 3 years ago

Hello,

i've doubt about relation to Referrer-Policy header and its relation with link rel attribute that i could not find described in any spec and i would welcome your clarification.

Supposing 1: setting the rel property of an HTML link to the value noreferrer is equivalent to set the same attribute to noreferrer noopener (because noreferrer implies noopener as stated explicitly stated in the specs

Supposing 2: setting the HTTP Referrer-Policy header to the value no-referrer is equivalent to set the rel property of any HTML link served within the request to the value noopener(is this statement correct?)

Is it correct to expect that setting the HTTP Referrer-Policy header would obtain exactly same result of setting the rel any HTML link served within the request to the value noreferrer noopener

Thank you!

hackademix commented 3 years ago

Supposing 2: setting the HTTP Referrer-Policy header to the value no-referrer is equivalent to set the rel property of any HTML link served within the request to the value noopener(is this statement correct?)

No, it's not.

Is it correct to expect that setting the HTTP Referrer-Policy header would obtain exactly same result of setting the rel any HTML link served within the request to the value noreferrer noopener

No it's not, because as you said no relationship between the HTTP Referrer-Policy header and the window.opener value in the target browsing context is stated anywhere by the specs.

However, depending on your use case, this might not be a big deal, since any link with target="_blank" defaults to noopener.

evilaliv3 commented 3 years ago

thank you so much @hackademix

i got probably confused in my first ipothesis (header set to no-referrer equal rel=noreferrer), but i understand from what you say that they are not related at all

annevk commented 3 years ago

They are related in that rel=noreferrer takes precedence, but that's about it. You might want to look at Cross-Origin-Opener-Policy.

evilaliv3 commented 3 years ago

Thank you @annevk, this advice is really helpful. I just looked at your suggestion and we are going to immediately implement it.