Browser & Web Performance · Middle · Question 62 of 75

What does `Referrer-Policy: strict-origin-when-cross-origin` (the browser default) send?

✓Correct answer: The full URL for same-origin requests, only the origin for cross-origin HTTPS requests, and nothing on HTTPS → HTTP
2The full URL to every site
3Never any referrer

Explanation

Full URLs can leak tokens or private paths to third parties; the default limits that.

Further reading

MDN: Referrer-Policy ↗

Test yourself

Take the Browser & Web Performance · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.