Referrer-Policy Not Implemented

Summary#

Invicti detected that no Referrer-Policy header implemented.

Referrer-Policy is a security header designed to prevent cross-domain Referer leakage.

Impact#

Referer header is a request header that indicates the site which the traffic originated from. If there is no adequate prevention in place, the URL itself, and even sensitive information contained in the URL will be leaked to the cross-site.

The lack of Referrer-Policy header might affect privacy of the users and site's itself

Actions To Take#

In a response header:

Referrer-Policy: no-referrer | same-origin | origin | strict-origin | no-origin-when-downgrading

In a META tag

<meta name="Referrer-Policy" value="no-referrer | same-origin"/>

In an element attribute

<a href="http://crosssite.example.com" rel="noreferrer"></a>

or

<a href="http://crosssite.example.com" referrerpolicy="no-referrer | same-origin | origin | strict-origin | no-origin-when-downgrading"></a>

Remediation#

Please implement a Referrer-Policy by using the Referrer-Policy response header or by declaring it in the meta tags. It’s also possible to control referrer information over an HTML-element by using the rel attribute.

Classifications#

CWE-200, ISO27001-A.14.2.5, OWASP 2013-A6, OWASP 2017-A3

Referrer-Policy Not Implemented

Related Articles

Build your resistance to threats. And save hundreds of hours each month.