Hey Emily,
I've added support for RP to Security Headers[1] now and naturally it'd be great to see the new states added to Chrome now that RP has reached W3C CR status. Any ETA on this?
Thanks!
[1] https://schd.io/1
Just since this has been open for quite a while, without much (or any?) activity, I'd just like to add another comment in support of this being implemented too.
I maintain a headers focused PHP library[1] in-which an upcoming version will include `Referrer-Policy: strict-origin-when-cross-origin` among its default header set.
Unfortunately due to this bug/issue, the `no-referrer` version of this header also must be included as a fallback (which obviously has its usability disadvantages), but remains the only value to offer at least the same security and privacy features, that is also supported by Chrome.
This just to say it would be great to see Chrome support RP (in-full) so that we can all start taking advantage of it!
[1]: https://github.com/aidantwoods/SecureHeaders/issues/19
It is also a official recommendation of the W3c https://www.w3.org/blog/news/archives/6087?pk_campaign=feed&pk_kwd=w3c-invites-implementations-of-referrer-policy
"The Web Application Security Working Group invites implementations of the Candidate Recommendation of Referrer Policy. This specification describes how Web authors can set a referrer policy for documents they create, and describes the impact on the Referer HTTP header for outgoing requests and navigations."
Another reason: as far as I can see in my CSP monitorings and log analysis, very sensitive informations can be provided via referrer. As responsible developers, we have to ask ourselves about this referrer question for the users, that might not know this mechanism.
I always take this example to explain the interest of Referer Policy: just imagine somebody putting a link to their company website on a forum dedicated to the help between people that had a cancer. The forum should be able to help protecting its users privacy from this potential issue.
And nobody want Chrome to be too late on this, right ? :)
c'mon, please cut us some slack. We wrote the spec, and implemented all but two policies years before anybody else. We'll eventually add the last two ones.
It's also not a recommendation, please do your homework before accusing others of ignoring an established standard.
Feel free to star the bug to follow development.
Comment 1 by jochen@chromium.org
, Feb 15 2017