Referrer

[annevk]

This is my current thinking with regards to integrating referrer support into Fetch (and the fetch() API).

Referrer should be copied from an existing Request object. However, it should be reset if any modifications are made to that Request object. This addresses the pass-through scenario for service workers and in particular the CORS CSS case (where the referrer is not same-origin). See also w3c/webappsec#413

Referrer should be allowed to be set to any same-origin URL (already possible through pushState() and other tricks).

Referrer should be allowed to be omitted.

Referrer will of course always be subject to the referrer policy of request's client.

In order to support the proposed referrer="" attribute there would also have to be a request's referrer policy (with referrer="" mapping to that rather than request's referrer). It's unclear at the moment what wins between a request's referrer policy and a request's client's referrer policy, though @sc0ttbeardsley from Yahoo! has expressed a preference for letting request's referrer policy win which seems to violate the spirit of CSP... See also w3c/webappsec#409

@jeisinger and @mikewest, any chance we can resolve this quickly?

[annevk]

http://krijnhoetmer.nl/irc-logs/whatwg/20150715#l-431 makes this more or less resolved.

[sc0ttbeardsley]

I'd be open to some other mechanism to allow certain page transitions to have a different policy than the document-level policy. Last I checked Chrome allows changing the document's meta referrer value via JS which works too, I suppose.

[jeisinger]

the conclusion was to add an attribute like referrerPolicy (not referrer, as that's already the referrer itself in fetch), and have it reflect valid values.

[wanderview]

Gecko implementation bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1184549

[mfalken]

Blink implementation bug: https://code.google.com/p/chromium/issues/detail?id=514092

[yutakahirano]

• global referrer policy should be used when request's referrer policy is the empty string.
• request's referrer policy should be used otherwise

Is that correct?

[annevk]

Yeah. A request's referrer policy takes precedence over a request's client's referrer policy.

[annevk]

The details of that need to be defined in the Referrer Policy Standard, though.

[yutakahirano]

Thank you!

[yutakahirano]

@annevk, @mikewest, @jeisinger, can you tell me how stable this feature is?
I have a chromium patch enabling RequestInit.referrer, but I'm a bit nervous about the spec stability, given that we are unshipping request context now.

[annevk]

My main worry would be that it has not received much scrutiny. Usually folks notice at least a few mistakes. So I'm not sure many have studied and approved the feature.

[yutakahirano]

Thanks, then I'll wait for a while.