Add Referrer-Policy no-referrer-when-cross-origin

[Shamar]

Please add a new Referrer Policy no-referrer-when-cross-origin that simply force the browser to behave like if no-referrer was specified for cross-origin requests and like if strict-origin was specified for same-origin requests.

[domfarolino]

Isn't this https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-same-origin?

[Shamar]

If so, the specification of same-origin Referrer Policy should clarify the correct behavior of the browser when the referrer is a potentially trustworthy URL but the current URL is not.

[domfarolino]

What is unclear about the current spec? The full referrer URL is sent if the request is same-origin, and not sent otherwise. The whole thing is contingent based on the URL's origin.

[Shamar]

Simply put, the presence of these examples under strict-origin but not under same-origin.

[domfarolino]

Every one of those examples under strict-origin are examples of cross-origin requests, because a difference in origin trustworthiness implies cross-origin. I guess we could add one of them to the same-origin example, since they are technically cross-origin, but the reason they exist in the strict-origin example is because they are really trying to showcase how the difference in origin-trustworthiness activates the logic unique to strict-origin.

I suppose we could add an example in the same-origin section of http://example.com fetching a script a https://example.com/script.js, and how that would NOT send a referrer. I'm happy to review a PR if you'd like to send one.

[Amir-Herzberg]

Adding an example would be nice, but it may be even more desirable to have a comment similar to the one in origin-when-cross-origin, to clarify the different treatment from strict-origin-when-cross-origin. The comment in origin-when-cross-origin is:

NOTE: For the "origin-when-cross-origin" policy, we also consider protocol upgrades, e.g. requests from http://example.com/ to https://example.com/, to be cross-origin-referrer requests.

Possible text for a comment for same-origin:

NOTE: For the "same-origin" policy, we also consider protocol upgrades, e.g. requests from http://example.com/ to https://example.com/, to be cross-origin-referrer requests.

[domfarolino]

Would you be willing to submit a PR to add this text? I'm happy to review it.