SEC-008
Referrer-Policy leaks full URLs
LowDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
The Referrer-Policy header or meta tag. A missing policy is fine: browsers default to strict-origin-when-cross-origin (Chrome 85+, Firefox 87+, Safari 15.2+), which Mozilla Observatory also accepts.
Why it matters
With unsafe-url or no-referrer-when-downgrade, full URLs (which can include reset tokens or IDs) are sent to every third-party site.
Recommended fix
Send Referrer-Policy: strict-origin-when-cross-origin.
How to verify
Confirm the header is present on the homepage response.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-008: Referrer-Policy leaks full URLs
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add the response header `Referrer-Policy: strict-origin-when-cross-origin` to all responses.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Confirm the header is present on the homepage response.