Intent to Ship: Referrer-Policy header

69 views
Skip to first unread message

Emily Stark

unread,
Oct 4, 2016, 2:45:45 PM10/4/16
to blink-dev

Contact emails

est...@chromium.org, joc...@chromium.org


Spec

https://w3c.github.io/webappsec-referrer-policy/


TAG review for Referrer Policy appears to have been done in https://github.com/w3ctag/spec-reviews/issues/36 though it did not include the Referrer-Policy header specifically.


Summary

The Referrer-Policy header allows pages to set a referrer policy by sending an HTTP response header.


The Referrer-Policy header allows web developers to set a referrer policy for a document without editing the HTML (as they would need to if they were to set the policy via <meta> tag). The Referrer-Policy header can also be applied on redirect responses, to modify the referrer policy and Referer header while following redirects.

Link to “Intent to Implement” blink-dev discussion

https://groups.google.com/a/chromium.org/d/msg/blink-dev/Umj9iVRJM70/6CG49IswBwAJ


Is this feature supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

Yes.


Interoperability and Compatibility Risk

Firefox 50 is shipping the Referrer-Policy header (https://developer.mozilla.org/en-US/Firefox/Releases/50), though there are no public signals from Edge or Safari.


web-platform-tests contains extensive tests for the Referrer-Policy header.


In the Intent to Implement thread, there was a mention that we should take extra care with this feature since there would be privacy implications to removing it. While there are still no public signals from Edge or Safari, I still think we should ship it because 1.) Firefox is shipping it, and 2.) the rest of the Referrer Policy spec is shipped despite carrying the same risk.


OWP launch tracking bug

https://crbug.com/619228


Entry on the feature dashboard

https://www.chromestatus.com/features/5639972996513792


Chris Harrelson

unread,
Oct 4, 2016, 8:38:22 PM10/4/16
to Emily Stark, blink-dev
LGTM1

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.

Jochen Eisinger

unread,
Oct 5, 2016, 1:07:09 AM10/5/16
to Chris Harrelson, Emily Stark, blink-dev
fwiw, I totally approve of this launch :)

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

Philip Jägenstedt

unread,
Oct 5, 2016, 6:05:21 AM10/5/16
to Jochen Eisinger, Chris Harrelson, Emily Stark, blink-dev
LGTM2

Alex Russell

unread,
Oct 5, 2016, 1:02:54 PM10/5/16
to Chris Harrelson, Emily Stark, blink-dev
Non-owner LGTM.

Darin Fisher

unread,
Oct 5, 2016, 1:06:13 PM10/5/16
to Alex Russell, Chris Harrelson, Emily Stark, blink-dev
LGTM3
Reply all
Reply to author
Forward
0 new messages