Referrer-Policy is an HTTP response header that controls how much information the browser attaches to the Referer header on outbound navigations. It exists to prevent leakage of secrets embedded in URLs (session tokens, password-reset codes, private page paths) and to preserve user privacy.
Header Format
Referrer-Policy: strict-origin-when-cross-originCommon Values
| Value | Behaviour |
|---|---|
no-referrer | Never send Referer at all |
same-origin | Send full referrer to same-origin, nothing to cross-origin |
strict-origin | Send only origin (scheme + host), and only to HTTPS |
strict-origin-when-cross-origin | Full URL to same-origin, origin only to cross-origin, nothing to insecure downgrades — the modern default |
unsafe-url | Send full URL always (dangerous) |
Why It Matters
If your password-reset link is https://example.com/reset?token=abc123, and the reset page links to https://cdn.example.com/logo.png, the CDN gets the full URL — including the token — in the Referer header. Log aggregation, third-party analytics, and CDN access logs all capture this. strict-origin-when-cross-origin prevents the leak.
Audit yours with the security headers checker.
Related
Check the CSP glossary entry, the Permissions-Policy entry, and read the HTTP security headers explainer.