Current URL is disclosed to DuckDuckGo

[dessant]

When visiting https://plausible.io/plausible.io/sources, favicons are fetched from https://icons.duckduckgo.com, and the current page URL is sent to their servers in the Referer header, which could be undesirable when Plausible is self-hosted.

The issue can be solved by setting the referrerpolicy attribute for image elements that point to other origins.

<img referrerpolicy="no-referrer" src="https://icons.duckduckgo.com/ip3/news.ycombinator.com.ico">

[JimDabell]

Which browser are you using? I was under the impression most browsers send the origin when HTTPS is in use these days, not the current URL. I just checked the URL you mentioned in Chrome and didn’t reproduce the behaviour you describe; Chrome sent the origin, not the current URL.

[dessant]

@JimDabell, the Referer header is sent for the favicon requests in all major browsers. You have probably inspected the wrong request, requests initiated by the <img> element do not send the Origin header, unless you enable CORS with the crossorigin attribute.

[dessant]

I see you were referring to this change in Chrome, not the Origin header. Chrome 85 and newer only sends the host part of the URL, though that still discloses the host at which the self-hosted instance can be accessed, the Referer header can be dropped entirely to avoid disclosing any data to DuckDuckGo.

[ukutaht]

Thanks for reporting. I agree we should add the referrerpolicy="no-referrer", no reason to share that data.