meta-tags icon indicating copy to clipboard operation
meta-tags copied to clipboard

Support for the`referrer` meta tag

Open molefrog opened this issue 4 years ago • 0 comments

Hi, first of all, thanks for the gem — our team has been using it for ages and we find it super helpful!

There is a meta tag called referrer (see Integration with HTML section) that is supported by modern browsers and allows to customize the Referrer policy. Why it may sound like this is something you wouldn't need very often, but the Referrer policy could be quite important from the security point of view.

A use case is the following: say you have an app that allows users to share their data via a unique secret link. Like a Google Doc accessible via a link, like your-app.com/link/103f133eded. You obviously want to keep the URL in secret, however, under regular circumstances browsers do attach the full URL into the request. This may lead to a situation when a request is made to third-party websites (like analytics) with the secret link included in the request. In order to restrict that your app could set the Referrer-Policy: same-origin header. Or, you can include it as a part of your HTML:

<meta name="referrer" content="same-origin">

Let me know what you think about adding this to the library, would love to assist and collaborate.

molefrog avatar Apr 09 '20 13:04 molefrog