Bug 272683 – Referrer-Policy 'unsafe-url' and co. supported for same-site URLs

• Status: NEW
• Component: Page Loading

WebKit still supports 'unsafe-url' and other values for 'same-site' URLs. 
I thought 'unsafe-url' and co. should only be allowed for 'same-origin' URLs.

Visit https://sub.headers.websec.saarland/_hp/tests/referrer-access-rp.sub.html?resp_type=basic&browser_id=1&label=RP&first_id=200&last_id=200&scheme=https&t_resp_id=200&t_element_relation=iframe_iframe&t_resp_origin=https://headers.websec.saarland
The site sub.header.websec.saarland sets a RP of 'unsafe-url' and the full URL is reported to the cross-origin same-site site headers.websec.saarland.

[Sam Sneddon [:gsnedders]]

This is to do with ITP's stripping of referrers, after Referrer-Policy has already been applied.

https://webkit.org/blog/9661/preventing-tracking-prevention-tracking/ says:

> ITP now downgrades all cross-site request referrer headers to just the page’s origin. Previously, this was only done for cross-site requests to classified domains.

It is perhaps surprising that we're doing this for cross-site rather than cross-origin, given it means that our behaviour cannot be described in terms of Referrer-Policy alone.

It would perhaps be worthwhile consider simply considering all weaker Referrer-Policy policies as identical to origin-when-cross-origin (v. the (non-existent) "origin-when-cross-site" of our current behaviour), or even just never allow anything weaker than the default strict-origin-when-cross-origin.

I did not find the blog post describing the current behavior. The browser compat data currently says Safari removed support for 'unsafe-url' in version 13: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#browser_compatibility

Brave seems to be never allowing anything weaker than the default `strict-origin-when-cross-origin`.

Firefox seems to be using the same `origin-when-cross-site`: https://bugzilla.mozilla.org/show_bug.cgi?id=1891510

[Radar WebKit Bug Importer]

<rdar://problem/126863403>