Referrer-Policy Needs Proper Fallback

Summary#

Invicti detected that the Referrer-Policy is defined empty.

Impact#

In the situation that the Referrer-Policy is defined empty, the fallback mechanism comes into play and the Referer information will be controlled by meta or rel attribute of each parameter from which traffics originated to cross-sites.

Remediation#

Please take into consideration that dynamically added URL into site context and also add adequate control for the current HTML-elements by using alternatives below --if these controls cause cross-site requests:

<meta name="referrer" value=""/>

<img referrerpolicy="" src=""/>

<a href referrerpolicy="" href=""></a>

<a href rel="" href=""></a>

Classifications#

ISO27001-A.14.2.5, OWASP 2017-A6, OWASP 2013-A6, CWE-200

Referrer-Policy Needs Proper Fallback

Related Articles

Build your resistance to threats. And save hundreds of hours each month.