diff --git a/source b/source index cb5050ddd2e..a53ab863296 100644 --- a/source +++ b/source @@ -2688,9 +2688,15 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • The parse a referrer policy from a `Referrer-Policy` header algorithm
  • The "no-referrer", "no-referrer-when-downgrade", - "origin-when-cross-origin", and + "same-origin", + "origin", + "strict-origin", + "origin-when-cross-origin", + "strict-origin-when-cross-origin", and "unsafe-url" referrer policies
  • The default referrer policy
  • +
  • Same-Origin-Referrer Requests
  • +
  • Cross-Origin-Referrer Requests
  • The following terms are defined in Mixed Content: MIX

    @@ -7386,12 +7392,75 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute

    Referrer policy attributes

    -

    A referrer policy attribute is an enumerated attribute. Each - referrer policy, including the empty string, is a keyword for this attribute, mapping - to a state of the same name.

    +

    A referrer policy attribute is an enumerated attribute with the + following keywords and states:

    + + + + + + + + + + + + + + +
    Keyword + State + Brief description +
    (the empty string) + No Referrer Policy + Causes a fallback to a referrer policy defined elsewhere. +
    no-referrer + No Referrer + Omits referrer entirely. +
    no-referrer-when-downgrade + No Referrer When Downgrade + Omits referrer for non-potentially trustworthy URLs. +
    same-origin + Same Origin + Omits referrer for cross-origin-referrer requests. +
    origin + Origin + Referrer header will only include the serialization of the origin. +
    strict-origin + Strict origin + Omits referrer for cross-origin-referrer + requests, otherwise only sends the serialization of the origin. +
    origin-when-cross-origin + Origin When Cross Origin + Cross-origin-referrer requests send only the serialization of the origin. +
    strict-origin-when-cross-origin + Strict Origin When Cross + Origin + Cross-origin-referrer requests may omit referrer, or send only the only the serialization of the origin, depending on potentially trustworthy URLs. +
    unsafe-url + Unsafe URL + Full referrer information is sent for both same-origin-referrer requests and + cross-origin-referrer requests. +

    The attribute's missing value default and invalid value default are both the empty string state.

    + data-x="invalid value default">invalid value default are both No Referrer Policy state.

    The impact of these states on the processing model of various fetches is defined in more detail throughout this specification, in