Web Security · Middle · Question 70 of 75

What is the risk the `Referrer-Policy` header reduces?

1Cookies being sent over HTTP
2Users being redirected to phishing sites
✓Correct answer: Leaking full URLs, including tokens or IDs in query strings, to other sites in the Referer header

Explanation

strict-origin-when-cross-origin (the browser default) sends only the origin to other sites. Reset links with tokens still shouldn't link out.

Further reading

MDN: Referrer-Policy ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.