referrerPolicy property of the
HTMLScriptElement interface reflects the HTML
referrerpolicy of the
<script> element and
fetches made by that script, defining which referrer is sent when fetching the resource.
refStr = scriptElem.referrerPolicy; scriptElem.referrerPolicy = refStr;
DOMString; one of the following:
Refererheader will be omitted entirely. No referrer information is sent along with requests.
- no-referrer-when-downgrade (default)
- This is the user agent's default behavior if no policy is specified. The URL is sent as a referrer when the protocol security level stays the same (e.g.HTTP→HTTP, HTTPS→HTTPS), but isn't sent to a less secure destination (e.g. HTTPS→HTTP).
- Only send the origin of the document as the referrer in all cases.
https://example.com/page.htmlwill send the referrer
- Send a full URL when performing a same-origin request, but only send the origin of the document for other cases.
- A referrer will be sent for same-site origins, but cross-origin requests will contain no referrer information.
- Only send the origin of the document as the referrer when the protocol security level stays the same (e.g. HTTPS→HTTPS), but don't send it to a less secure destination (e.g. HTTPS→HTTP).
- Send a full URL when performing a same-origin request, only send the origin when the protocol security level stays the same (e.g. HTTPS→HTTPS), and send no header to a less secure destination (e.g. HTTPS→HTTP).
- Send a full URL when performing a same-origin or cross-origin request. This policy will leak origins and paths from TLS-protected resources to insecure origins. Carefully consider the impact of this setting.
Note: An empty string value (
"") is both the default
value, and a fallback value if
referrerpolicy is not supported. If
referrerpolicy is not explicitly specified on the
<script> element, it will adopt a higher-level referrer policy,
i.e. one set on the whole document or domain. If a higher-level policy is not
available, the empty string is treated as being equivalent to
var scriptElem = document.createElement("script"); scriptElem.src = "/"; scriptElem.referrerPolicy = "unsafe-url"; document.body.appendChild(scriptElem);
The definition of 'referrerpolicy attribute' in that specification.
|Candidate Recommendation||Added the
|HTML Living Standard
The definition of 'HTMLScriptElement: referrerPolicy' in that specification.
BCD tables only load in the browser