Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 36eb3da

Browse files
authored
Merge pull request #3233 from wdscxsj/patch-6
strict-origin-when-cross-origin is now the default referrerPolicy
2 parents 91e8edd + 75edb67 commit 36eb3da

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

‎5-network/06-fetch-api/article.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ let promise = fetch(url, {
2424
body: undefined, // string, FormData, Blob, BufferSource, or URLSearchParams
2525
referrer: "about:client", // or "" to send no Referer header,
2626
// or an url from the current origin
27-
referrerPolicy: "no-referrer-when-downgrade", // no-referrer, origin, same-origin...
27+
referrerPolicy: "strict-origin-when-cross-origin", // no-referrer-when-downgrade, no-referrer, origin, same-origin...
2828
mode: "cors", // same-origin, no-cors
2929
credentials: "same-origin", // omit, include
3030
cache: "default", // no-store, reload, no-cache, force-cache, or only-if-cached
@@ -85,26 +85,26 @@ Unlike the `referrer` option that allows to set the exact `Referer` value, `refe
8585

8686
Possible values are described in the [Referrer Policy specification](https://w3c.github.io/webappsec-referrer-policy/):
8787

88-
- **`"no-referrer-when-downgrade"`** -- the default value: full `Referer` is always sent, unless we send a request from HTTPS to HTTP (to the less secure protocol).
88+
- **`"strict-origin-when-cross-origin"`** -- the default value: for same-origin send the full `Referer`, for cross-origin send only the origin, unless it's HTTPS→HTTP request, then send nothing.
89+
- **`"no-referrer-when-downgrade"`** -- full `Referer` is always sent, unless we send a request from HTTPS to HTTP (to the less secure protocol).
8990
- **`"no-referrer"`** -- never send `Referer`.
9091
- **`"origin"`** -- only send the origin in `Referer`, not the full page URL, e.g. only `http://site.com` instead of `http://site.com/path`.
9192
- **`"origin-when-cross-origin"`** -- send the full `Referer` to the same origin, but only the origin part for cross-origin requests (as above).
9293
- **`"same-origin"`** -- send the full `Referer` to the same origin, but no `Referer` for cross-origin requests.
9394
- **`"strict-origin"`** -- send only the origin, not the `Referer` for HTTPS→HTTP requests.
94-
- **`"strict-origin-when-cross-origin"`** -- for same-origin send the full `Referer`, for cross-origin send only the origin, unless it's HTTPS→HTTP request, then send nothing.
9595
- **`"unsafe-url"`** -- always send the full url in `Referer`, even for HTTPS→HTTP requests.
9696

9797
Here's a table with all combinations:
9898

9999
| Value | To same origin | To another origin | HTTPS→HTTP |
100100
|-------|----------------|-------------------|------------|
101101
| `"no-referrer"` | - | - | - |
102-
| `"no-referrer-when-downgrade"` or `""` (default) | full | full | - |
102+
| `"no-referrer-when-downgrade"` | full | full | - |
103103
| `"origin"` | origin | origin | origin |
104104
| `"origin-when-cross-origin"` | full | origin | origin |
105105
| `"same-origin"` | full | - | - |
106106
| `"strict-origin"` | origin | origin | - |
107-
| `"strict-origin-when-cross-origin"` | full | origin | - |
107+
| `"strict-origin-when-cross-origin"` or `""` (default) | full | origin | - |
108108
| `"unsafe-url"` | full | full | full |
109109

110110
Let's say we have an admin zone with a URL structure that shouldn't be known from outside of the site.

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /