On March 22, 2021, Firefox announced that Firefox 87 introduces a stricter, more privacy-preserving default referrer policy. From now on, Firefox will trim path and query string information from the Referer header by default, preventing sites from accidentally leaking sensitive user data.
Starting with Firefox 87 we set the default referrer policy to strict-origin-when-cross-origin, which strips sensitive user information reachable from the URL. Original source: https://blog.mozilla.org/security/2021/03/22/firefox-87-trims-http-referrers-by-default-to-protect-user-privacy
Chrome made strict-origin-when-cross-origin the default back in the July 2020 Chrome 85 update: https://developers.google.com/web/updates/2020/07/referrer-policy-new-chrome-default
Browsers send the HTTP Referer header (note: the original spec spells it “Referer”) to signal to a site’s server where the user came from. More precisely, browsers have traditionally sent the full URL of the referring document (usually the address bar URL) in the Referer header, and included it on nearly every navigation or subresource (image, style, script) request. Sites use referrer information for plenty of fairly innocent purposes, including analytics, logging, and cache optimization.
But Referer headers often carry private user data: they can reveal which articles a user was reading on the referring site, or even contain account-related information from that site.
Referrer Policy was introduced in browsers to give sites better control over referrer values, providing a mechanism to protect user privacy. Yet if a site sets no referrer policy at all, browsers typically fall back to no-referrer-when-downgrade, which trims the referrer when navigating to a less secure destination (say, from https: to http:) but otherwise sends the full URL — including path and query — of the original document as the referrer.
The Referer Request Header
The Referer header carries the address of the page that linked to the current request, i.e. showing that the current page was reached through a link on that source page. Servers commonly use it to identify where visitors came from, and may base analytics, logging, or cache optimization decisions on it.
What This Breaks
First, some systems rely on the Referer header to tell which page a user came from. A login page may use it to send users back where they were before logging in; with the referrer trimmed, users land somewhere wrong after login and hit an error page.
Second, the analytics tools we rely on may no longer see the user’s source page — only the domain they arrived from — leaving stats incomplete or inaccurate.
For individual users, though, this is good news: it protects privacy, since the browser no longer tells the requested site which page you came from.