A new default Referrer-Policy for Chrome - strict-origin-when-cross-origin | Blog | Chrome for Developers

Before we start: If you're unsure of the difference between "site" and "origin", check out Understanding "same-site" and "same-origin". The Referer header is missing an R, due to an original misspelling in the spec. The Referrer-Policy header and referrer in JavaScript and the DOM are spelled correctly. Summary Browsers are evolving towards privacy-enhancing default referrer policies, to provide a

[nilab]

"Chrome plans to gradually enable strict-origin-when-cross-origin as the default policy in 85; this may impact use cases relying on the referrer value from another origin.", "To try out the change in Chrome, enable the flag at chrome://flags/#reduced-referrer-granularity."

[efcl]

ChromeのReferrer-Policyのデフォルト値が`strict-origin-when-cross-origin`に変更されることによる影響について。 `Origin`や`Sec-Fetch-Site`での代替えなどについて

[Shisama]

Chrome 85 から Referrer-Policy のデフォルト値が strict-origin-when-cross-origin になる。cross-origin の場合、 HTTPS → HTTP では Referer を送信しないし、HTTPS 同士でも Origin しか送らないようになる。その影響と対策について書かれている