0

I am creating a class (es) in php to validate if referrers received in the headers adhere to the Referrer-policy set for the document.

I have tried to create a table which will tell me when a referer is sent and what to expect in them. However I could not find relevant information for the following cases:

  1. origin-when-cross-origin - what to expect for same origin requests when the protocol improves
  2. strict-origin - what to expect for same origin requests when the protocol improves

Reference Document

The below table shows the current status of where I am.

referrer-policy so & ps so & pi so & pd co & ps co & pi co & pd
no-referrer none none none none none none
no-referrer-when-downgrade comUrl comUrl none comUrl comUrl none
origin origin origin origin origin origin origin
origin-when-cross-origin comUrl ?? origin origin origin origin
same-origin comUrl comUrl comUrl none none none
strict-origin origin ?? none origin origin none
strict-origin-when-cross-origin comUrl comUrl none orgin origin none
unsafe-url comUrl comUrl comUrl comUrl comUrl comUrl

Please read the table as per the following legends

  • so -> same origin,
  • co -> cross origin,
  • ps -> protocol same (http -> http, https -> https),
  • pi -> protocol improves (http -> https)
  • pd -> protocol downgrades (https -> http or https -> file and I assume http -> file too),
  • Origin -> scheme, hostname, and port
  • comUrl -> origin, path, and querystring (basically skips user, pass and fragment ie. anything after #)

So what is the expected response in the two cases? Also am I correct in assuming a protocol downgrade when an http page makes a request to file

endeavour
  • 576
  • 4
  • 15
  • I don’t have an answer, but I hope you are testing this in multiple browsers from multiple eras, too. – Chris Haas Jun 29 '21 at 12:04
  • @ChrisHaas Well this is from the docs only. I have not tested these yet. Is there no place they have documented the behavior across browsers. I mean installing that many versions may take susbtantial time and effort. Is that the only way to get to the bottom of this? – endeavour Jun 29 '21 at 13:34

0 Answers0