菜单
Use when reviewing HTTP response headers for privacy hardening on any website that handles authentication, session state, or sensitive URL parameters.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/thedaviddias/Front-End-Checklist --skill referrer-policy命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | referrer-policy |
| description | Use when reviewing HTTP response headers for privacy hardening on any website that handles authentication, session state, or sensitive URL parameters. |
| metadata | {"category":"security","priority":"medium","difficulty":"beginner","estimatedTime":"10","source":"frontendchecklist.io","url":"https://frontendchecklist.io/en/rules/security/referrer-policy"} |
Without a Referrer-Policy, a password reset link like https://example.com/reset?token=abc123 is included in the Referer header when the user clicks an external link on that page — leaking the token to third parties.
Referrer-Policy: strict-origin-when-cross-origin — the recommended modern defaultstrict-origin-when-cross-origin sends the full URL for same-origin requests, only the origin for cross-origin HTTPS, and nothing for HTTPS→HTTPunsafe-url — it sends the full URL including path and query string to every external site<meta> tag, or the referrerpolicy attribute on individual <a> and <img> elementsCheck whether the server sends a Referrer-Policy header and verify the value is appropriate. The recommended value is strict-origin-when-cross-origin. Check for any pages with sensitive URL parameters that could be leaked via the Referer header.
Add Referrer-Policy: strict-origin-when-cross-origin to all HTTP responses. Configure it in your web server, CDN, or application framework. For pages with particularly sensitive URLs, consider no-referrer or same-origin.
Explain what the Referer header contains, how a permissive Referrer-Policy can leak sensitive URL parameters to third parties, and what the difference is between the various Referrer-Policy values.
Review server config, headers, forms, and integration points related to Set a Referrer-Policy header. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/en/rules/security/referrer-policy