3 ms·
> Browsers have gradually stripped it down to just the origin The big caveat is that the new browser policies will only default to origin if the website didn't
by bryans 5y ago
> Browsers have gradually stripped it down to just the origin
The big caveat is that the new browser policies will only default to origin if the website didn't specify the header, which means the website owner is still in control of whether it gets shared with the third party.
- morelisp 5y agoIf you mean the originating website, it could send its own URL in any header or parameter, so masking its ability to set Referer would be useless without also some complex supporting feature like ITP / Privacy Budget.