Skip to content

Support for thereferrer meta tag #210

@molefrog

Description

@molefrog

Hi, first of all, thanks for the gem — our team has been using it for ages and we find it super helpful!

There is a meta tag called referrer (see Integration with HTML section) that is supported by modern browsers and allows to customize the Referrer policy. Why it may sound like this is something you wouldn't need very often, but the Referrer policy could be quite important from the security point of view.

A use case is the following: say you have an app that allows users to share their data via a unique secret link. Like a Google Doc accessible via a link, like your-app.com/link/103f133eded. You obviously want to keep the URL in secret, however, under regular circumstances browsers do attach the full URL into the request. This may lead to a situation when a request is made to third-party websites (like analytics) with the secret link included in the request. In order to restrict that your app could set the Referrer-Policy: same-origin header. Or, you can include it as a part of your HTML:

<meta name="referrer" content="same-origin">

Let me know what you think about adding this to the library, would love to assist and collaborate.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions