Well if the referrer header matches the shared url it's just bloat in the request headers, and if it doesn't it's possibly leaking details it shouldn't, like pe

Well if the referrer header matches the shared url it's just bloat in the request headers, and if it doesn't it's possibly leaking details it shouldn't, like perhaps a token in a query parameter. Twitter, Facebook, etc doesn't really need to know where a user initiated a share anyway. Either way making sure that window.opener isn't available to random sites is a critical security feature and in some browsers that require you to set noreferrer, so better safe than sorry.