You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi, first of all, thanks for the gem — our team has been using it for ages and we find it super helpful!
There is a meta tag called referrer (see Integration with HTML section) that is supported by modern browsers and allows to customize the Referrer policy. Why it may sound like this is something you wouldn't need very often, but the Referrer policy could be quite important from the security point of view.
A use case is the following: say you have an app that allows users to share their data via a unique secret link. Like a Google Doc accessible via a link, like your-app.com/link/103f133eded. You obviously want to keep the URL in secret, however, under regular circumstances browsers do attach the full URL into the request. This may lead to a situation when a request is made to third-party websites (like analytics) with the secret link included in the request. In order to restrict that your app could set the Referrer-Policy: same-origin header. Or, you can include it as a part of your HTML:
<metaname="referrer" content="same-origin">
Let me know what you think about adding this to the library, would love to assist and collaborate.
The text was updated successfully, but these errors were encountered:
molefrog
changed the title
Support for referrer meta tag
Support for thereferrer meta tag
Apr 9, 2020
Hi, first of all, thanks for the gem — our team has been using it for ages and we find it super helpful!
There is a meta tag called
referrer
(see Integration with HTML section) that is supported by modern browsers and allows to customize the Referrer policy. Why it may sound like this is something you wouldn't need very often, but the Referrer policy could be quite important from the security point of view.A use case is the following: say you have an app that allows users to share their data via a unique secret link. Like a Google Doc accessible via a link, like
your-app.com/link/103f133eded
. You obviously want to keep the URL in secret, however, under regular circumstances browsers do attach the full URL into the request. This may lead to a situation when a request is made to third-party websites (like analytics) with the secret link included in the request. In order to restrict that your app could set theReferrer-Policy: same-origin
header. Or, you can include it as a part of your HTML:Let me know what you think about adding this to the library, would love to assist and collaborate.
The text was updated successfully, but these errors were encountered: