Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Default to 'strict-origin-when-cross-origin'. #125

Closed
wants to merge 2 commits into from
Closed

Default to 'strict-origin-when-cross-origin'. #125

wants to merge 2 commits into from

Conversation

mikewest
Copy link
Member

@mikewest mikewest commented Oct 15, 2019 •
edited by pr-preview bot
Loading

This addresses #121, and will be followed
with a corresponding patch to Fetch (where the default is currently
defined).

Preview | Diff

@mikewest
Default to 'strict-origin-when-cross-origin'.
565f216 
This addresses #121, and will be followed
with a corresponding patch to Fetch (where the default is currently
defined).
@mikewest
Copy link
Member Author

cc @annevk and @johnwilander again for the same question.

mikewest added a commit to whatwg/fetch that referenced this pull request Oct 15, 2019
@mikewest
Change the default referrer policy to 'strict-origin-when-cross-origin'.
a44f2f5 
This addresses
w3c/webappsec-referrer-policy#125, among other
things.
@mikewest mikewest mentioned this pull request Oct 15, 2019
Closed
@domenic
Copy link
Collaborator

domenic commented Oct 15, 2019

You may want to change the legacy <meta>-only mapping in HTML too: https://html.spec.whatwg.org/multipage/semantics.html#meta-referrer

@annevk
Copy link
Member

annevk commented Oct 15, 2019

Would it be an option to wait with landing this until it's successfully shipped in one browser?

annevk
annevk reviewed Oct 15, 2019
View reviewed changes
index.src.html
<a>"<code>no-referrer-when-downgrade</code>"</a>. This defaulting happens in
the [[#determine-requests-referrer]] algorithm.
no such higher-level policy is available, falling back to the <a>default referrer
policy</a>. This happens in Fetch's main fetch algorithm, for example.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where else would it happen?

Copy link

@krgovind krgovind Jul 30, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mikewest I'm working on shepherding this change through. Could you help answer @annevk 's question? I'm not sure if this is purely a clarification question or if it needs to result in a change in this PR?

@ehsan
Copy link

ehsan commented Oct 18, 2019

Would it be an option to wait with landing this until it's successfully shipped in one browser?

FWIW Firefox since version 59 has been shipping this as the default referrer policy in private browsing mode.

@annevk
Copy link
Member

annevk commented Nov 20, 2019

See also https://bugzilla.mozilla.org/show_bug.cgi?id=1589074.

@tungnh28 tungnh28 mentioned this pull request Jan 14, 2020
Open
@Malvoz Malvoz mentioned this pull request Feb 15, 2020
Open
@Darkspirit Darkspirit mentioned this pull request Mar 14, 2020
Open
@kiding
Copy link

kiding commented Apr 25, 2020 •
edited
Loading

Safari seems to do a similar thing by default (as a subfeature of ITP) since 13.0.4/13.3; but only for third-party requests, not for cross-origin top navigations.

@johnwilander
Copy link

johnwilander commented Apr 26, 2020 •
edited
Loading

Safari’s change is not a change of default policy. Sites can’t change it, only users can. Third-party referrers are downgraded to origin by default regardless of the referrer policy set by the website.

@englehardt englehardt mentioned this pull request Apr 29, 2020
Open
@krgovind krgovind mentioned this pull request Jul 21, 2020
Closed
@laukstein laukstein mentioned this pull request Jul 26, 2020
Closed
@krgovind krgovind mentioned this pull request Aug 3, 2020
Merged
@krgovind
Copy link

krgovind commented Aug 5, 2020

@mikewest Would it make sense to abandon this PR in favor of #142?

@domfarolino
Copy link
Member

Closing this in favor of #142, as @krgovind has taken this work over.

@domfarolino domfarolino deleted the default branch January 19, 2021 19:11
@zrhoffman zrhoffman mentioned this pull request Jan 28, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@annevk annevk annevk left review comments

@krgovind krgovind krgovind left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@mikewest @domenic @annevk @ehsan @kiding @johnwilander @krgovind @domfarolino