Referrer Policy (Web)

What is Referrer Policy (Web)?

The Referrer Policy is a security feature that controls how much referrer information is sent with requests originating from a web page. This information, known as the referrer header, typically includes the URL of the page from which the request was initiated. It helps servers understand where traffic is coming from and allows for analytics and logging.

In practice, web browsers adhere to the referrer policy set by a website to determine the value of the ‘Referer’ HTTP request header. This policy dictates whether the full URL, just the origin, or no referrer information is sent to the destination server. Websites can specify a referrer policy using HTTP headers or meta tags, influencing privacy and security for users navigating the web.

Understanding and implementing appropriate referrer policies is crucial for balancing website functionality, user privacy, and security. Incorrectly configured policies can lead to privacy leaks or hinder legitimate cross-origin interactions. Therefore, developers must carefully consider the implications of different policy settings.

Key Takeaways

• The Referrer Policy dictates how much URL information is included in the ‘Referer’ HTTP header sent from a browser.
• Policies range from sending the full URL to sending no referrer information at all.
• Websites can set their referrer policy via HTTP headers or meta tags.
• Proper configuration is essential for balancing functionality, privacy, and security.

Understanding Referrer Policy (Web)

The ‘Referer’ HTTP header is a standard part of web communication, indicating the address of the webpage that initiated a request for another webpage. For instance, if a user clicks a link on an article about baking and lands on a recipe page, the ‘Referer’ header sent to the recipe page would typically be the URL of the baking article. This information is valuable for website owners to track traffic sources and understand user navigation patterns.

However, sending the full URL can expose sensitive information, such as session IDs, user tokens, or parts of URLs containing personal data, to the destination server. This poses a privacy risk, especially when navigating between different domains or when the originating page contains private user information. The Referrer Policy was introduced as a mechanism to mitigate these risks by allowing websites to control the granularity of the referrer information shared.

By setting a specific referrer policy, website administrators can choose to send only the origin (scheme, host, and port) of the URL, or no referrer information at all, depending on the sensitivity of the content and the nature of the cross-site navigation. This provides a finer level of control over data exposure compared to the browser’s default behavior.

Formula

Referrer Policies are typically set using string values rather than a mathematical formula. These strings define the conditions under which referrer information is sent. Common policy values include:

• no-referrer: No referrer information is sent.
• no-referrer-when-downgrade: The referrer is sent when navigating from HTTPS to HTTPS, but not when navigating from HTTPS to HTTP.
• origin: Only the origin (scheme, host, port) of the document is sent.
• origin-when-cross-origin: The full URL is sent when the origin matches, but only the origin is sent when navigating to a different origin.
• same-origin: The full URL is sent when navigating within the same origin, but no referrer is sent when navigating to a different origin.
• strict-origin: Similar to origin-when-cross-origin, but also includes no-referrer-when-downgrade behavior.
• strict-origin-when-cross-origin: The full URL is sent for same-origin requests, the origin is sent for cross-origin requests, and no referrer is sent when navigating from HTTPS to HTTP.
• unsafe-url: The full URL is always sent.

Real-World Example

Consider a user browsing an e-commerce site. They are on a product page (e.g., `https://example.com/products/widget?id=123`). They click a link to read customer reviews hosted on a separate domain (e.g., `https://reviews.example-other.com/widget-reviews`).

If the product page has a referrer policy of no-referrer-when-downgrade, and both pages use HTTPS, the ‘Referer’ header sent to `reviews.example-other.com` would be `https://example.com/products/widget?id=123`. However, if the product page were HTTP and the review page HTTPS, no referrer would be sent.

If the policy were origin-when-cross-origin, only `https://example.com/` would be sent to the review site, protecting the specific product details from being revealed to the third-party review domain.

Importance in Business or Economics

For businesses, referrer policies are critical for managing user privacy and data security. By controlling referrer data, companies can prevent sensitive information from being inadvertently exposed when users navigate between their own subdomains or to third-party services.

This practice helps build user trust and comply with privacy regulations like GDPR or CCPA, which mandate data protection. It also enables businesses to perform accurate analytics by understanding traffic sources without compromising user anonymity. For businesses relying on advertising or affiliate programs, accurate referrer data (or controlled exposure of it) is essential for tracking conversions and attributing sales.

Furthermore, a well-defined referrer policy can influence the user experience by ensuring that legitimate functionalities, like passing user context between related services, are maintained while preventing potential security vulnerabilities.

Types or Variations

Referrer policies are primarily defined by the string values associated with them, as listed in the ‘Formula’ section. The variations represent different levels of information disclosure: from complete disclosure to absolute privacy.

The choice of policy often depends on the context of the navigation. For internal links within a secure site, more information might be safely shared. For links to external sites, especially those handling sensitive data or for marketing purposes, a more restrictive policy is usually preferred.

The