Chapter 69: Subresource Integrity (SRI) & Referrer Policy

Referrer Policy Directive Tokens & Comparison

**Part 14: Security & Best Practices** — Chapter 69: Subresource Integrity (SRI) & Referrer Policy

LEARNING OBJECTIVES ⌵
  • Understand all 8 W3C Referrer Policy directive tokens.
  • Differentiate between no-referrer, same-origin, strict-origin, and strict-origin-when-cross-origin.
  • Prevent HTTPS-to-HTTP downgrade leakage.
  • Select the optimal balance between analytics visibility and privacy compliance.
🎬 INTERACTIVE VISUAL PIPELINE Core Architecture Simulation
🌐
1. Input
Directives & Tags
⚙️
2. Parse
Tokenizer & AST
🌳
3. Layout
Box Model & Flow
🎨
4. Render
GPU Paint & Composite
PHASE 1: INPUT & DIRECTIVES
Browser receives declarative markup stream, parsing tag tokens and initializing component state.

Directive Tokens Comparison Matrix

Directive Token Same-Origin Request Cross-Origin HTTPS $\rightarrow$ HTTPS HTTPS $\rightarrow$ HTTP Downgrade
no-referrer No Referer sent No Referer sent No Referer sent (0 info)
same-origin Full URL (https://app.com/p/1?q=a) No Referer sent No Referer sent
origin Origin only (https://app.com) Origin only (https://app.com) Origin only
strict-origin Origin only Origin only No Referer sent
strict-origin-when-cross-origin (Default) Full URL Origin only No Referer sent
no-referrer-when-downgrade Full URL Full URL No Referer sent
unsafe-url Full URL Full URL Full URL (Dangerous! ❌)

📌 Key Takeaways

  • strict-origin-when-cross-origin is the modern browser default: sends full URL to same-origin, only the domain origin to cross-origin HTTPS, and nothing over insecure HTTP.
  • Never use unsafe-url in production environments.
  • --

❓ Knowledge Check

1. Which of the following is correct?

2. Which of the following is correct?