Referrer-Policy

Controls how much referrer URL information browsers send with outgoing requests.

`strict-origin-when-cross-origin` is a sensible modern default: keep the full path same-origin, but send only the origin cross-origin.

securityprivacyheaderreferrer

Recommended default (http)

Referrer-Policy: strict-origin-when-cross-origin

Referrer data can contain paths or query parameters that reveal sensitive information. A policy limits what is sent to linked sites and third-party resources.

For particularly sensitive applications, no-referrer or same-origin may be appropriate, but they can reduce analytics and debugging context.

Common mistakes

Putting secrets in URLs and assuming Referrer-Policy is the only protection needed.
Using unsafe-url, which can send full URLs across origins.

IANA registry: http-fields/field-names

Registry reference: Referrer Policy

Content-Security-Policy (CSP)SameSite Cookie Attribute

Sources

MDN Web Docs: HTTP