It looks like element-level referrer-policies set via the HTML attribute `referrerpolicy` aren't honored. This can be tested on this [test site](https://site-one-dot-referrer-demo-280711.ey.r.appspot.com/stuff/detail?tag=red&p=p2). It looks like the problem has been fixed in Safari 14 (Desktop), but I can still reproduce in Safari 12 on an older iPhone. More details [here](https://lists.webkit.org/pipermail/webkit-dev/2020-September/031404.html).
If this only reproduces on a 2 year old release, then I don't see how this is a bug to track here. Can you reproduce on iOS 14? That said, there were other bug reports about referrerpolicy interaction with other features like ITP, including bug 206957 and bug 215356, so maybe this is related? Could you please attach a self contained test that doesn't require for the app spot URL to remain live?
Thanks Alexey! An update: On mac Safari 14.0 with ITP on: (tested on my machine) ---------- Element-level `referrerpolicy` are honored, even `no-referrer-when-downgrade`, on *all* types of elements: iframes, a (navigations), images and scripts. On iOS 14: (tested on BrowserStack) ---------- Two observations: • Element-level `referrerpolicy` are honored, except `no-referrer-when-downgrade` - Meaning, in these cases, the Referer header is only the origin. Which in my understanding may be due to ITP. *But* one other interesting behaviour: When `referrerpolicy` is `no-referrer-when-downgrade` on an `a` element: `document.referrer` is only the origin, but the `Referer` header is the full URL i.e. honors the policy. • This also means that the behaviour is different than on mac, why could this be? I'm testing on BrowserStack, so it could be some special settings. On mac Safari 13 and iOS 13: ---------- Element-level `referrerpolicy` are not honored, even when they're *stricter* than the document's policy. Re: Self-contained test that doesn't require for the app spot URL to remain live. Will post a link here, let me update the code. In the meantime, the appspot URL will remain live!
Note: I see [here](https://github.com/privacycg/proposals/issues/13#issuecomment-707242581) that the document.referrer vs Referer header behaviour difference is to be expected.
<rdar://problem/70576228>