referrer-policy

What is referrer-policy?

The referrer-policy npm package is used to set the Referrer-Policy HTTP header in web applications. This header controls how much referrer information is included with requests made from your site.

What are referrer-policy's main functionalities?

Set Referrer-Policy Header

This feature allows you to set the Referrer-Policy header for your web application. In this example, the policy is set to 'no-referrer', which means that the Referer header will be omitted entirely.

const referrerPolicy = require('referrer-policy');
const express = require('express');
const app = express();

app.use(referrerPolicy({ policy: 'no-referrer' }));

app.get('/', (req, res) => {
  res.send('Referrer-Policy is set to no-referrer');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

Multiple Policy Options

This feature allows you to choose from multiple policy options for the Referrer-Policy header. In this example, the policy is set to 'strict-origin-when-cross-origin', which means that full URL referrer information is sent for same-origin requests, but only the origin is sent for cross-origin requests.

const referrerPolicy = require('referrer-policy');
const express = require('express');
const app = express();

app.use(referrerPolicy({ policy: 'strict-origin-when-cross-origin' }));

app.get('/', (req, res) => {
  res.send('Referrer-Policy is set to strict-origin-when-cross-origin');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

Other packages similar to referrer-policy

helmet

Helmet is a collection of 15 smaller middleware functions that set various HTTP headers to help secure your Express.js app. One of these middleware functions is `helmet.referrerPolicy()`, which can be used to set the Referrer-Policy header. Helmet provides a more comprehensive security solution compared to referrer-policy, as it includes additional protections like Content Security Policy, XSS Filter, and more.

README

Referrer Policy

Looking for a changelog?

The Referer HTTP header is typically set by web browsers to tell the server where it's coming from. For example, if you click a link on example.com/index.html that takes you to wikipedia.org, Wikipedia's servers will see Referer: example.com. This can have privacy implications—websites can see where you are coming from. The new Referrer-Policy HTTP header lets authors control how browsers set the Referer header.

Read the spec to see the options you can provide.

Usage:

var referrerPolicy = require('referrer-policy')

app.use(referrerPolicy({ policy: 'same-origin' }))
// Referrer-Policy: same-origin

app.use(referrerPolicy({ policy: 'unsafe-url' }))
// Referrer-Policy: unsafe-url

app.use(referrerPolicy())
// Referrer-Policy: no-referrer