1

The Referrer-Policy header controls how much referrer information the browser exposes to a site when navigating to it. I understand the purpose of this header when set on HTML files; does it make sense to set this header on non-HTML resources like images, scripts, etc.? Does any browser pay attention to the header’s value in this situation?

2

I think it makes sense to include it on non-HTML content. Not all content can create referrals, but HTML content is not the only thing that can. Flash, for example, often does. CSS can include URL info for fonts and background images, if not other content. In addition, unless I didn't understand the policy correctly, the policy applies to any request, not just to page navigation. Therefore, when the CSS uses a remote resource as a background image, the retrieval of that image is supposed to follow the policy in effect at the time of that fetch. By extrapolation, the same should apply to anything else that requests a resource; Flash, PDF files, JavaScript, etc. The flip side is that browser support, according to the link you provided, is spotty at best. Mostly Firefox, possibly other Mozilla products as well. IE is totally non-supportive, and even Chrome and Safari only provide basic support.

Browser support tables

Source: MDN Referrer Policy

So, if you need the security from setting that header, you should probably look for other methods as well.

-1

Yes, it does makes sense because Non HTML files can contain sensitive data. If a browser does not check the referrer policy of a http request then anyone can access any files.

An example of this is http cookies; An unchecked malicious script could easily access sensitive information stored in cookies if the referrer-policy was not checked.

Using the data in the referrer-policy means you can apply security concepts such as same-origin policy.

To quote Wikipedia:

This policy prevents malicious scripts on one page from obtaining access to sensitive data on another webpage through that pages document object model.

Wikipedia article

1
  • “If a browser does not check the referrer policy of a http request then anyone can access any files.” I think you’re talking about something other than the Referrer-Policy header, which controls how much information is sent in the Referer header.
    – bdesham
    Feb 27 '17 at 15:57
-1

does it make sense to set this header on non-HTML resources like images, scripts, etc.?

No, it's irrelevant because the referrer-policy header is not sent for those page assets.

Test for yourself, substituting example.com for another domain. Alternatively, you can use the web developer tools of your browser (if it supports this) to examine headers with a GUI.

curl --head https://www.example.com/index.html | grep referrer-policy
curl --head https://www.example.com/favicon.ico | grep referrer-policy
curl --head https://www.example.com/image.jpeg | grep referrer-policy

Only the index.html resource is sent with that header value.

2
  • You’re making unfounded assumptions. My server does send a Referrer-Policy for non-HTML assets, because I configured it that way. I asked the question because I don’t know whether this setup is actually useful.
    – bdesham
    Feb 27 '17 at 15:54
  • Edit your question to include the non-standard configuration you use (your decision to send Referrer-Policy for non-HTML assets) and you'll get better answers. My answer works for a typical use-case. Also, what do you mean "Does any browser pay attention to the header’s value in this situation"?. You can easily verify that a browser receives the header you sent for any asset, so what is your goal here please? Are you trying to improve privacy, or security, or something else? Feb 27 '17 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.