Repository navigation
Referrer-Policy changes within the .htaccess file will not be applied. #14374
Description
Referrer-Policy changes within the .htaccess file will not be applied.
Steps to reproduce
- Change referrer policy in your
.htaccessfile fromno-referrertostrict-origin-when-cross-origin.
Header set Referrer-Policy "strict-origin-when-cross-origin"
- Place somewhere a
.phpfile on a webserver with the following contents:
<?php
var_dump($_SERVER);- Use the browser development tools to place a link on
DOMAIN.TLD/loginwhich points to your.phpfile on your webserver. - Click on that link and search for the
HTTP_REFERERkey in the output that the.phpfile you created produces.
Expected behaviour
You should be able to see the HTTP_REFERER field.
Actual behaviour
There is no HTTP_REFERER field.
Server configuration
Operating system:
Linux
Web server:
Apache
Nextcloud version: (see Nextcloud admin page)
15.0.4
Signing status:
Signing status
No errors have been found.
Are you using encryption: yes
Client configuration
Browser:
Firefox 66.0b10 & 65.0.1
Chrome 72.0.3626.119
Operating system:
Windows
Activity
kesselb commentedon Feb 25, 2019
How is this related to nextcloud?
DominikWA commentedon Feb 25, 2019
I had the same problem, after a quick digging in I found out that there are meta tags that also sets the referral-policy. Here you can find my fix #14318.
Best,
Dominik
kesselb commentedon Feb 25, 2019
This could be the reason 👍
iPaat commentedon Feb 25, 2019
This helped, thanks a lot.
Hopefully it will be merged soon so that my source code doesn't deviate from the original.
Are there any security risks if I remove the meta tags as suggested?