ASVS 5.0 requirement V3.4.5 says your application must set a referrer policy, so the Referer request header does not leak sensitive data to third party services. You can do it with the Referrer-Policy response header or with HTML attributes. Sensitive data includes URL paths and query strings, and for internal applications the hostname as well. It is a Level 2 requirement.
Why it matters
When a user clicks a link or the page loads an image, script or font from another site, the browser tells that site where the user came from. By default modern browsers send the origin plus path and query for same origin requests, and the origin only for cross origin ones when the page is HTTPS. But older defaults, explicit unsafe-url settings and some embedded contexts send the full URL.
URLs often hold things they should not: password reset tokens, document ids, search terms, session identifiers in badly designed apps. If that URL reaches an analytics vendor, an ad network or any linked site, it is now in their logs. An internal tool also reveals its hostname, which tells outsiders what you run and where.
How to implement it
Set one policy for every response:
Referrer-Policy: strict-origin-when-cross-origin
That sends the full URL within your own site, only the origin to other HTTPS sites, and nothing on a downgrade to HTTP. For internal or high sensitivity apps use no-referrer.
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
app.use(helmet.referrerPolicy({ policy: "no-referrer" }));
For a single link, such as one leading to an external site:
<a href="https://partner.example.net" rel="noopener noreferrer">Partner</a>
or the meta equivalent <meta name="referrer" content="no-referrer"> in the page head. The header is preferred because it covers every response.
Also keep secrets out of URLs. A policy reduces leakage but a token in a query string is still stored in history and server logs.
How to test it
curl -sI https://app.example.com/ | grep -i referrer-policy
The value must not be unsafe-url, no-referrer-when-downgrade or empty. Then verify the behavior: open developer tools, Network tab, load a page that includes a third party resource and look at the Referer request header on that call. It should show only the origin, or nothing.
Common mistakes
Relying on browser defaults. Defaults vary by browser version. State the policy.
Using unsafe-url. It sends the full URL everywhere.
Policy on HTML only. Set it for all responses.
Tokens in query strings. Move them to POST bodies or headers.
Quick check
Which policy should I pick?
strict-origin-when-cross-origin is a good default for public sites. Use no-referrer for internal apps or pages with sensitive URLs.
Sources
- OWASP ASVS 5.0, requirement V3.4.5
- MDN: Referrer-Policy
