HTTP参考手册
标题 | Headers
Referrer-Policy
所述Referrer-PolicyHTTP 标头支配其引荐信息，在所发送的Referer报头，应包含的请求。
Header type |
Response header |
|---|---|
Forbidden header name |
no |
句法
请注意，这Referer实际上是“推荐人”一词的拼写错误。该Referrer-Policy头不同意这一拼写错误。
Referrer-Policy: no-referrer
Referrer-Policy: no-referrer-when-downgrade
Referrer-Policy: origin
Referrer-Policy: origin-when-cross-origin
Referrer-Policy: same-origin
Referrer-Policy: strict-origin
Referrer-Policy: strict-origin-when-cross-origin
Referrer-Policy: unsafe-url指令
Referer头将被完全省略。没有引用信息与 requests.no-referrer-when-downgrade 一起发送（默认）如果没有指定策略，这是用户代理的默认行为。原始地址作为引用来源发送到先验为多安全目的地（HTTPS-> HTTPS），但不会发送到安全性较低的目标（HTTPS-> HTTP）。原始只发送文档的来源作为引用者在所有情况下。
文档https://example.com/page.html将发送引用者https://example.com/.origin-when-cross-origin 在执行同源请求时发送完整的 URL，但仅将文档的来源发送给其他案例 .same-origin 将引用同一站点源的引用来源，但交叉源请求将不包含引用信息。严格来源仅将文档的来源作为引荐来源发送到先验为安全多目的地（HTTPS-> HTTPS），但不要将其发送到较少安全目标（HTTPS-> HTTP）.strict-origin-when-cross-origin 在执行同源请求时发送完整URL，仅将文档的来源发送到先验为多安全目标（HTTPS-> HTTPS），并且不向不太安全的目标发送头（HTTPS-> HTTP）.unsafe-url 在执行同源或跨源请求时发送完整的 URL（从参数中剥离）。
此政策会将来自 TLS 保护资源的来源和路径泄漏到不安全的来源。仔细考虑这个设置的影响。
例子
Policy |
Document |
Navigation to |
Referrer |
|---|---|---|---|
no-referrer |
https://example.com/page.html |
any domain or path |
no referrer |
no-referrer-when-downgrade |
https://example.com/page.html |
https://example.com/otherpage.html |
https://example.com/page.html |
no-referrer-when-downgrade |
https://example.com/page.html |
https://mozilla.org |
https://example.com/page.html |
no-referrer-when-downgrade |
https://example.com/page.html |
http://example.org |
no referrer |
origin |
https://example.com/page.html |
any domain or path |
https://example.com/ |
origin-when-cross-origin |
https://example.com/page.html |
https://example.com/otherpage.html |
https://example.com/page.html |
origin-when-cross-origin |
https://example.com/page.html |
https://mozilla.org |
https://example.com/ |
origin-when-cross-origin |
https://example.com/page.html |
http://example.com/page.html |
https://example.com/ |
same-origin |
https://example.com/page.html |
https://example.com/otherpage.html |
https://example.com/page.html |
same-origin |
https://example.com/page.html |
https://mozilla.org |
no referrer |
strict-origin |
https://example.com/page.html |
https://mozilla.org |
https://example.com/ |
strict-origin |
https://example.com/page.html |
http://example.org |
no referrer |
strict-origin |
http://example.com/page.html |
any domain or path |
http://example.com/ |
strict-origin-when-cross-origin |
https://example.com/page.html |
https://example.com/otherpage.html |
https://example.com/page.html |
strict-origin-when-cross-origin |
https://example.com/page.html |
https://mozilla.org |
https://example.com/ |
strict-origin-when-cross-origin |
https://example.com/page.html |
http://example.org |
no referrer |
unsafe-url |
https://example.com/page.html |
any domain or path |
https://example.com/page.html |
产品规格
Specification |
Status |
|---|---|
Referrer Policy |
Editor's draft |
浏览器兼容性
Feature |
Chrome |
Firefox |
Edge |
Internet Explorer |
Opera |
Safari |
|---|---|---|---|---|---|---|
Basic Support |
56.0 |
50.0 |
(No) |
(No) |
(No) |
(No) |
same-origin |
(No)1 |
52.0 |
(No) |
(No) |
(No) |
(No) |
strict-origin |
(No)1 |
52.0 |
(No) |
(No) |
(No) |
(No) |
strict-origin-when-cross-origin |
(No)1 |
52.0 |
(No) |
(No) |
(No) |
(No) |
Feature |
Android |
Chrome for Android |
Edge mobile |
Firefox for Android |
IE mobile |
Opera Android |
iOS Safari |
|---|---|---|---|---|---|---|---|
Basic Support |
56.0 |
(No) |
(No) |
50.0 |
(No) |
(No) |
(No) |
same-origin |
(No) |
(No) |
(No) |
52.0 |
(No) |
(No) |
(No) |
strict-origin |
(No) |
(No) |
(No) |
52.0 |
(No) |
(No) |
(No) |
strict-origin-when-cross-origin |
(No) |
(No) |
(No) |
52.0 |
(No) |
(No) |
(No) |
注意：从版本53开始，Gecko 提供了一个about:config，允许用户设置其默认值Referrer-Policy- network.http.referer.userControlPolicy。可能的值是：
- 0 —
no-referrer - 1 —
same-origin - 2 —
strict-origin-when-cross-origin - 3 —
no-referrer-when-downgrade(the default)
加载中,请稍侯......