PHANTOM
🇮🇳 IN
Skip to content

Point mapping of <meta> referrer tag for the legacy 'default' to RP spec#5783

Merged
domenic merged 3 commits intowhatwg:masterfrom
krgovind:master
Dec 14, 2020
Merged

Point mapping of <meta> referrer tag for the legacy 'default' to RP spec#5783
domenic merged 3 commits intowhatwg:masterfrom
krgovind:master

Conversation

@krgovind
Copy link
Contributor

@krgovind krgovind commented Aug 4, 2020

This is a companion to w3c/webappsec-referrer-policy/pull/142 which introduces a new default referrer policy constant in the referrer-policy spec. We should point the mapping of the legacy default referrer policy specified via <meta> tags to the default value defined in that spec.


/infrastructure.html ( diff )
/semantics.html ( diff )

Copy link
Member

@domenic domenic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You seem to have signed up to participate as an individual, but I believe you work in the field of web technologies, so were not able to sign that way. You can instead follow the instructions at https://sites.google.com/a/google.com/web-standards/home/standards-organizations/whatwg

@krgovind krgovind requested a review from domenic August 4, 2020 22:02
Copy link
Member

@domenic domenic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with nits, thank you!

Copy link
Member

@domenic domenic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Tagging as "do not merge yet" until w3c/webappsec-referrer-policy#142 gets merged, but I'm happy to merge when that lands. Great stuff!

Oh, also feel free to add your name to the Acknowledgments section if you'd like! See https://github.com/whatwg/html/blob/master/CONTRIBUTING.md#pull-requests for some more details.

@domenic domenic added do not merge yet Pull request must not be merged per rationale in comment normative change security/privacy There are security or privacy implications labels Aug 5, 2020
@domenic domenic self-assigned this Aug 10, 2020
@krgovind
Copy link
Contributor Author

@domenic w3c/webappsec-referrer-policy#142 has landed. Can we merge this now please?

annevk pushed a commit to whatwg/fetch that referenced this pull request Nov 30, 2020
w3c/webappsec-referrer-policy#142 links tests and has the corresponding Referrer Policy change. whatwg/html#5783 has the corresponding change to HTML.
@annevk annevk removed the do not merge yet Pull request must not be merged per rationale in comment label Nov 30, 2020
@annevk annevk requested a review from domenic November 30, 2020 13:23
@domenic
Copy link
Member

domenic commented Nov 30, 2020

Still LGTM, but are there web platform tests for this specific change, i.e. for <meta name="referrerpolicy" content="default">?

@davidvancleve
Copy link

It looks like both default and the other legacy keywords origin-when-crossorigin, always, and never are covered by Blink web tests but not the WPTs.

@domenic
Copy link
Member

domenic commented Nov 30, 2020

Ah OK. Can we get some coverage then, before we merge this change?

@annevk annevk added the needs tests Moving the issue forward requires someone to write tests label Dec 1, 2020
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Dec 2, 2020
…licy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

This behavior is currently covered by a number of generated WPTs
(delivery type "meta" in the spec.src.json), but it doesn't cover a
handful of "legacy" keywords that the spec supports:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL adds test coverage for these keywords by adding new test cases
to referrer-policy/spec.src.json. It also incorporates a behavior change
proposed in a new spec pull request whatwg/html#5783,
which updates the "default" meta tag keyword to, instead of
being statically mapped to "no-referrer-when-downgrade" (which, until
recently, *was* the default policy), cross-reference the actual default
policy value. Finally, it removes a few now-redundant Blink web tests
covering the behavior the new WPTs verify.

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Dec 2, 2020
…licy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Dec 2, 2020
…licy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Dec 3, 2020
…licy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833114}
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Dec 3, 2020
…licy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833114}
pull bot pushed a commit to FreddyZeng/chromium that referenced this pull request Dec 3, 2020
…licy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833114}
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this pull request Dec 5, 2020
…> use the default referrer policy, a=testonly

Automatic update from web-platform-tests
Make <meta name=referrer content=default> use the default referrer policy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833114}

--

wpt-commits: 260262e3293459fed0f73c430100706abdc32a45
wpt-pr: 26710
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this pull request Dec 7, 2020
…> use the default referrer policy, a=testonly

Automatic update from web-platform-tests
Make <meta name=referrer content=default> use the default referrer policy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833114}

--

wpt-commits: 260262e3293459fed0f73c430100706abdc32a45
wpt-pr: 26710
sidvishnoi pushed a commit to sidvishnoi/gecko-webmonetization that referenced this pull request Dec 10, 2020
…> use the default referrer policy, a=testonly

Automatic update from web-platform-tests
Make <meta name=referrer content=default> use the default referrer policy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833114}

--

wpt-commits: 260262e3293459fed0f73c430100706abdc32a45
wpt-pr: 26710
sidvishnoi pushed a commit to sidvishnoi/gecko-webmonetization that referenced this pull request Dec 10, 2020
…> use the default referrer policy, a=testonly

Automatic update from web-platform-tests
Make <meta name=referrer content=default> use the default referrer policy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833114}

--

wpt-commits: 260262e3293459fed0f73c430100706abdc32a45
wpt-pr: 26710
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this pull request Dec 14, 2020
…> use the default referrer policy, a=testonly

Automatic update from web-platform-tests
Make <meta name=referrer content=default> use the default referrer policy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshigechromium.org>
Reviewed-by: Jeremy Roman <jbromanchromium.org>
Commit-Queue: David Van Cleve <davidvcchromium.org>
Cr-Commit-Position: refs/heads/master{#833114}

--

wpt-commits: 260262e3293459fed0f73c430100706abdc32a45
wpt-pr: 26710

UltraBlame original commit: 89d283f63157d10eb91f606a16cd1ec72302b99d
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this pull request Dec 14, 2020
…> use the default referrer policy, a=testonly

Automatic update from web-platform-tests
Make <meta name=referrer content=default> use the default referrer policy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshigechromium.org>
Reviewed-by: Jeremy Roman <jbromanchromium.org>
Commit-Queue: David Van Cleve <davidvcchromium.org>
Cr-Commit-Position: refs/heads/master{#833114}

--

wpt-commits: 260262e3293459fed0f73c430100706abdc32a45
wpt-pr: 26710

UltraBlame original commit: 89d283f63157d10eb91f606a16cd1ec72302b99d
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this pull request Dec 14, 2020
…> use the default referrer policy, a=testonly

Automatic update from web-platform-tests
Make <meta name=referrer content=default> use the default referrer policy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshigechromium.org>
Reviewed-by: Jeremy Roman <jbromanchromium.org>
Commit-Queue: David Van Cleve <davidvcchromium.org>
Cr-Commit-Position: refs/heads/master{#833114}

--

wpt-commits: 260262e3293459fed0f73c430100706abdc32a45
wpt-pr: 26710

UltraBlame original commit: 89d283f63157d10eb91f606a16cd1ec72302b99d
@krgovind
Copy link
Contributor Author

WPTs have been added in web-platform-tests/wpt/pull/26710 (thanks @davidvancleve !)

@domenic domenic removed the needs tests Moving the issue forward requires someone to write tests label Dec 14, 2020
@domenic
Copy link
Member

domenic commented Dec 14, 2020

Awesome, thanks! Merging now.

@domenic domenic merged commit e695a02 into whatwg:master Dec 14, 2020
bhearsum pushed a commit to mozilla-releng/staging-firefox that referenced this pull request May 1, 2025
…> use the default referrer policy, a=testonly

Automatic update from web-platform-tests
Make <meta name=referrer content=default> use the default referrer policy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833114}

--

wpt-commits: 260262e3293459fed0f73c430100706abdc32a45
wpt-pr: 26710
bhearsum pushed a commit to mozilla-releng/staging-firefox that referenced this pull request May 1, 2025
…> use the default referrer policy, a=testonly

Automatic update from web-platform-tests
Make <meta name=referrer content=default> use the default referrer policy

The HTML meta tag allows one to set a document's referrer policy by
providing values to
  <meta rel=referrer content={referrer policy here}>

In addition to all of the referrer policy identifiers (unsafe-url,
no-referrer-when-downgrade, etc), the HTML spec allows a few legacy
values for the "content" attribute:
  "never" is treated as if it instead read "no-referrer",
  "always" as "unsafe-url",
  "origin-when-crossorigin" as "origin-when-cross-origin", and
  "default" as "no-referrer-when-downgrade".

This CL incorporates a behavior change proposed in a new spec pull
request whatwg/html#5783, which updates the
"default" meta tag keyword to, instead of being statically mapped to
no-referrer-when-downgrade", cross-reference the actual default policy
value.

It also adds test coverage for all of the legacy keywords by adding new
test cases to wpt/referrer-policy/spec.src.json; the referrer policy
WPTs didn't previously cover this behavior.

Additionally, the CL removes a few now-redundant Blink web tests
covering the behavior that WPTs now verify.

This change is web-visible, but I think it's arguably covered by the
recently shipped change updating the default referrer policy from its
previous value of no-referrer-when-downgrade to a new value of
strict-origin-when-cross-origin. [1] At the time the <meta> behavior was
originally written into the spec, there wasn't an explicit single source
of truth for the "default referrer policy" per se: instead, specs
(Fetch, HTML, and the WebAppSec Referrer Policy spec) individually
defined fallback behavior in "no policy specified" cases by referring
specifically to the "no-referrer-when-downgrade" policy value.

[1]: https://groups.google.com/a/chromium.org/g/blink-dev/c/lqFuqwZDDR8/m/nKPRTc7DAQAJ

Fixed: 1154350
Change-Id: Ifb3bf9aa9f773c64af1a6e79f39511cf1c1bd8fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567977
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833114}

--

wpt-commits: 260262e3293459fed0f73c430100706abdc32a45
wpt-pr: 26710
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

normative change security/privacy There are security or privacy implications

Development

Successfully merging this pull request may close these issues.

4 participants