1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
|
<h3>Referrer Policy Settings</h3>
<p>
When loading pages and navigating through links, a web browser sends some information about the origin of the request,
by filling the <a href="https://tools.ietf.org/html/rfc7231#section-5.5.2" title="'Referer' section from the standard IETF specification">"Referer"</a> HTTP header.
Visited websites can process this information as they wish, so this can become a privacy concern, for example when coming from a page which contains searched terms in its URL.
</p>
<p>
This page offers some configuration settings to instruct your browser how it should fill this referrer information.
Beware that every browser behaves differently: some settings may be unsupported by your particular browser and therefore ignored.
If you are really concerned about privacy, please check what is really sent by your browser by using its embedded developer tools network console, or with the network traffic analyzer of your choice.
</p>
<form action="SettingsAck_p.html" method="post" class="form-horizontal">
<input type="hidden" name="transactionToken" value="#[transactionToken]#"/>
<fieldset>
<legend>Global policy</legend>
<p>
This referrer policy applies for every page on this peer. It is set by the "meta" HTML tag.
</p>
<p> Values are sorted by decreasing privacy level.
See the related <a href="https://www.w3.org/TR/referrer-policy/#referrer-policies">W3C recommendation</a> for full details and available values.
</p>
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicyNoReferrer"
type="radio" #(metaPolicyNoReferrerChecked)#::checked#(/metaPolicyNoReferrerChecked)#
value="no-referrer" aria-describedby="metaPolicyNoReferrerInfo"/>
no-referrer
</label>
</div>
</div>
<div class="col-sm-8" id="metaPolicyNoReferrerInfo">
Highest privacy setting: referrer information should never be sent, even when navigating on this peer internal links.
Be careful with this: some websites might reject requests with no referrer.
</div>
</div>
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicySameOrigin"
type="radio" #(metaPolicySameOriginChecked)#::checked#(/metaPolicySameOriginChecked)#
value="same-origin" aria-describedby="metaPolicySameOriginInfo"/>
same-origin
</label>
</div>
</div>
<div class="col-sm-8" id="metaPolicySameOriginInfo">
Peer internal links: referrer information should be stripped from any private data and contain only this peer host name.<br/>
External links: referrer information should never be sent.
</div>
</div>
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicyStrictOrigin"
type="radio" #(metaPolicyStrictOriginChecked)#::checked#(/metaPolicyStrictOriginChecked)#
value="strict-origin" aria-describedby="metaPolicyStrictOriginInfo"/>
strict-origin
</label>
</div>
</div>
<div class="col-sm-8" id="metaPolicyStrictOriginInfo">
Peer internal and external links: referrer information should be stripped from any private data and contain only this peer host name.<br/>
Restriction: when a link downgrades from a TLS secured connection (https) on this peer to an unsecured target (http), no referrer information at all should be sent.
</div>
</div>
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicyOrigin"
type="radio" #(metaPolicyOriginChecked)#::checked#(/metaPolicyOriginChecked)#
value="origin" aria-describedby="metaPolicyOriginInfo"/>
origin
</label>
</div>
</div>
<div class="col-sm-8" id="metaPolicyOriginInfo">
Peer internal and external links: referrer information should be stripped from any private data and contain only this peer host name.<br/>
Note: this value is also compatible with legacy values from the older <a href="https://wiki.whatwg.org/wiki/Meta_referrer">specification draft</a>.
</div>
</div>
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicyStrictOriginWhenCrossOrigin"
type="radio" #(metaPolicyStrictOriginWhenCrossOriginChecked)#::checked#(/metaPolicyStrictOriginWhenCrossOriginChecked)#
value="strict-origin-when-cross-origin" aria-describedby="metaPolicyStrictOriginWhenCrossOriginInfo"/>
strict-origin-when-cross-origin
</label>
</div>
</div>
<div class="col-sm-8" id="metaPolicyStrictOriginWhenCrossOriginInfo">
Peer internal links: referrer information should contain full URLs.<br/>
External links: referrer information should be stripped from any private data and contain only this peer host name.<br/>
Restriction: when an external link downgrades from a TLS secured connection (https) on this peer to an unsecured target (http), no referrer information at all should be sent.
</div>
</div>
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicyOriginWhenCrossOrigin"
type="radio" #(metaPolicyOriginWhenCrossOriginChecked)#::checked#(/metaPolicyOriginWhenCrossOriginChecked)#
value="origin-when-cross-origin" aria-describedby="metaPolicyOriginWhenCrossOriginInfo"/>
origin-when-cross-origin
</label>
</div>
</div>
<div class="col-sm-8" id="metaPolicyOriginWhenCrossOriginInfo">
Peer internal links: referrer information should contain full URLs.<br/>
External links: referrer information should be stripped from any private data and contain only this peer host name.
</div>
</div>
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicyNoReferrerWhenDowngrade"
type="radio" #(metaPolicyNoReferrerWhenDowngradeChecked)#::checked#(/metaPolicyNoReferrerWhenDowngradeChecked)#
value="no-referrer-when-downgrade" aria-describedby="metaPolicyNoReferrerWhenDowngradeInfo"/>
no-referrer-when-downgrade
</label>
</div>
</div>
<div class="col-sm-8" id="metaPolicyNoReferrerWhenDowngradeInfo">
Referrer information should contain full URLs, except when a link downgrades from a TLS secured connection (https) on this peer to an unsecured target (http).
</div>
</div>
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicyEmpty"
type="radio" #(metaPolicyEmptyChecked)#::checked#(/metaPolicyEmptyChecked)#
value="" aria-describedby="metaPolicyEmptyInfo"/>
empty value
</label>
</div>
</div>
<div class="col-sm-8" id="metaPolicyEmptyInfo">
Default browser behavior: it should correspond to "no-referrer-when-downgrade".
</div>
</div>
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicyUnsafeUrl"
type="radio" #(metaPolicyUnsafeUrlChecked)#::checked#(/metaPolicyUnsafeUrlChecked)#
value="unsafe-url" aria-describedby="metaPolicyUnsafeUrlInfo"/>
unsafe-url
</label>
</div>
</div>
<div class="col-sm-8" id="metaPolicyUnsafeUrlInfo">
Unsafe setting: referrer information should always contain full URLs.
</div>
</div>
#(metaPolicyCustom)#::
<div class="form-group">
<div class="col-sm-4">
<div class="radio">
<label>
<input name="metaPolicy" id="metaPolicyCustom"
type="radio" #(checked)#::checked#(/checked)#
value="#[value]#" aria-describedby="metaPolicyCustomInfo"/>
#[value]#
</label>
</div>
</div>
<div class="col-sm-7 alert alert-warning" id="metaPolicyCustomInfo" role="alert">
Custom setting: probably manually edited, be sure this value is the desired one.
</div>
</div>
#(/metaPolicyCustom)#
</fieldset>
<fieldset>
<legend>Search results links</legend>
<div class="form-group">
<div class="col-sm-4">
<div class="checkbox">
<label>
<input name="searchResultNoReferrer" id="searchResultNoReferrer"
type="checkbox" #(searchResultNoReferrerChecked)#::checked#(/searchResultNoReferrerChecked)#
aria-describedby="searchResultNoReferrerInfo"/>
Add the "noreferrer" link type to search results links
</label>
</div>
</div>
<div class="col-sm-8" id="searchResultNoReferrerInfo">
<p>When checked, this overrides the global referrer policy and adds the standard "noreferrer"
<a href="https://www.w3.org/TR/html/links.html#allowed-keywords-and-their-meanings" title="Link types section at W3C HTML specification">link type</a> to search results links,
thus instructing the browser that it should not send any referrer information at all when visiting them.</p>
<p>Be careful with this: some websites might reject requests with no referrer.</p>
<p>It is a standard HTML5 attribute value,
supported by many more browsers than the meta tag: if you want a higher level of privacy but use an old or incompatible browser,
this can be a valuable option.</p>
</div>
</div>
</fieldset>
<div class="col-sm-6">
<input type="submit" class="btn btn-primary" name="referrerPolicySettings" value="Submit" aria-describedby="submitInfo"/>
<em id="submitInfo">Changes will take effect immediately.</em>
</div>
</form>
|
