Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Editorial: add referrer policy table #9946

Closed
wants to merge 1 commit into from
Closed

Editorial: add referrer policy table #9946

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 74 additions & 5 deletions source
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2688,9 +2688,15 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
<li>The <dfn data-x="parse-referrer-policy-header" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#parse-referrer-policy-from-header">parse a referrer policy from a `<code>Referrer-Policy</code>` header</dfn> algorithm</li>
<li>The "<dfn data-x="referrer-policy-no-referrer" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer"><code>no-referrer</code></dfn>",
"<dfn data-x="referrer-policy-no-referrer-when-downgrade" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer-when-downgrade"><code>no-referrer-when-downgrade</code></dfn>",
"<dfn data-x="referrer-policy-origin-when-cross-origin" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin-when-cross-origin"><code>origin-when-cross-origin</code></dfn>", and
"<dfn data-x="referrer-policy-same-origin" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-same-origin"><code>same-origin</code></dfn>",
"<dfn data-x="referrer-policy-origin" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin"><code>origin</code></dfn>",
"<dfn data-x="referrer-policy-strict-origin" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin"><code>strict-origin</code></dfn>",
"<dfn data-x="referrer-policy-origin-when-cross-origin" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin-when-cross-origin"><code>origin-when-cross-origin</code></dfn>",
"<dfn data-x="referrer-policy-strict-origin-when-cross-origin" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin-when-cross-origin"><code>strict-origin-when-cross-origin</code></dfn>", and
"<dfn data-x="referrer-policy-unsafe-url" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-unsafe-url"><code>unsafe-url</code></dfn>" referrer policies</li>
<li>The <dfn data-x-href="https://w3c.github.io/webappsec-referrer-policy/#default-referrer-policy">default referrer policy</dfn></li>
<li><dfn data-x-href="https://w3c.github.io/webappsec-referrer-policy/#same-origin-referrer-request">Same-Origin-Referrer Requests</dfn></li>
<li><dfn data-x-href="https://w3c.github.io/webappsec-referrer-policy/#cross-origin-referrer-request">Cross-Origin-Referrer Requests</dfn></li>
</ul>

<p>The following terms are defined in <cite>Mixed Content</cite>: <ref>MIX</ref></p>
Expand Down Expand Up @@ -7386,12 +7392,75 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute

<h4>Referrer policy attributes</h4>

<p>A <dfn export>referrer policy attribute</dfn> is an <span>enumerated attribute</span>. Each
<span>referrer policy</span>, including the empty string, is a keyword for this attribute, mapping
to a state of the same name.</p>
<p>A <dfn export>referrer policy attribute</dfn> is an <span>enumerated attribute</span> with the
following keywords and states:</p>

<table>
<thead>
<tr>
<th>Keyword
<th>State
<th>Brief description
<tbody>
<tr>
<td>(the empty string)
<td><dfn data-x="referrerpolicy-no-referrerpolicy-state">No Referrer Policy</dfn>
<td>Causes a fallback to a <span>referrer policy</span> defined elsewhere.
<tr>
<td><dfn attr-value for="hyperlink-referrerpolicy"><code
data-x="attr-hyperlink-referrerpolicy-no-referrer">no-referrer</code></dfn>
<td><span data-x="referrer-policy-no-referrer">No Referrer</span>
<td>Omits <span data-x="http-referer">referrer</span> entirely.
<tr>
<td><dfn attr-value for="hyperlink-referrerpolicy"><code
data-x="attr-hyperlink-referrerpolicy-no-referrer-when-downgrade">no-referrer-when-downgrade</code></dfn>
<td><span data-x="referrer-policy-no-referrer-when-downgrade">No Referrer When Downgrade</span>
<td>Omits <span data-x="http-referer">referrer</span> for non-<span data-x="Is url potentially
trustworthy?">potentially trustworthy URLs</span>.
<tr>
<td><dfn attr-value for="hyperlink-referrerpolicy"><code
data-x="attr-hyperlink-referrerpolicy-same-origin">same-origin</code></dfn>
<td><span data-x="referrer-policy-same-origin">Same Origin</span>
<td>Omits <span data-x="http-referer">referrer</span> for <span>cross-origin-referrer requests</span>.
<tr>
<td><dfn attr-value for="hyperlink-referrerpolicy"><code
data-x="attr-hyperlink-referrerpolicy-origin">origin</code></dfn>
<td><span data-x="referrer-policy-origin">Origin</span>
<td><span data-x="http-referer">Referrer</span> header will only include the <span
data-x="serialization of an origin">serialization of the origin</span>.
<tr>
<td><dfn attr-value for="hyperlink-referrerpolicy"><code
data-x="attr-hyperlink-referrerpolicy-strict-origin">strict-origin</code></dfn>
<td><span data-x="referrer-policy-strict-origin">Strict origin</span>
<td>Omits <span data-x="http-referer">referrer</span> for <span>cross-origin-referrer
requests</span>, otherwise only sends the <span data-x="serialization of an
origin">serialization of the origin</span>.
<tr>
<td><dfn attr-value for="hyperlink-referrerpolicy"><code
data-x="attr-hyperlink-referrerpolicy-origin-when-cross-origin">origin-when-cross-origin</code></dfn>
<td><span data-x="referrer-policy-origin-when-cross-origin">Origin When Cross Origin</span>
<td><span>Cross-origin-referrer requests</span> send only the <span data-x="serialization of an
origin">serialization of the origin</span>.
<tr>
<td><dfn attr-value for="hyperlink-referrerpolicy"><code
data-x="attr-hyperlink-referrerpolicy-strict-origin-when-cross-origin">strict-origin-when-cross-origin</code></dfn>
<td><span data-x="referrer-policy-strict-origin-when-cross-origin">Strict Origin When Cross
Origin</span>
<td><span>Cross-origin-referrer requests</span> may omit <span
data-x="http-referer">referrer</span>, or send only the only the <span data-x="serialization of
an origin">serialization of the origin</span>, depending on <span data-x="Is url potentially
trustworthy?">potentially trustworthy URLs</span>.
<tr>
<td><dfn attr-value for="hyperlink-referrerpolicy"><code
data-x="attr-hyperlink-referrerpolicy-unsafe-url">unsafe-url</code></dfn>
<td><span data-x="referrer-policy-unsafe-url">Unsafe URL</span>
<td>Full referrer information is sent for both <span>same-origin-referrer requests</span> and
<span>cross-origin-referrer requests</span>.
</table>

<p>The attribute's <i data-x="missing value default">missing value default</i> and <i
data-x="invalid value default">invalid value default</i> are both the empty string state.</p>
data-x="invalid value default">invalid value default</i> are both <span
data-x="referrerpolicy-no-referrerpolicy-state">No Referrer Policy</span> state.</p>

<p>The impact of these states on the processing model of various <span
data-x="concept-fetch">fetches</span> is defined in more detail throughout this specification, in
Expand Down