referrer
The CSP referrer directive was a pre-CSP3 experiment for controlling the Referer header. Use the Referrer-Policy header instead.
Last update:
The referrer Content Security Policy (CSP) directive was a pre-CSP3
experimental directive for controlling the Referer header a page sends with
outgoing requests. It was never standardized and has been removed from
browsers.
Deprecated
referrer was an experimental directive that never made it into the CSP specification. The platform standardized referrer control as the dedicated Referrer-Policy header instead of a CSP directive, so browsers removed referrer. Set Referrer-Policy in its place.
Use the replacement instead:
Referrer-Policy: strict-origin-when-cross-originWhat you should do instead
Referrer behavior got its own header. Set
Referrer-Policy
on your responses; the OWASP HTTP Headers cheat sheet recommends
strict-origin-when-cross-origin, the value shown above.
Delete referrer from any policy that still carries it; it controls nothing in
current browsers. You can check which security headers a live page sends,
including Referrer-Policy, with the
security headers scanner.
Why it was removed
referrer predates CSP Level 3 and was only ever an experiment. The platform
standardized referrer control as a dedicated Referrer-Policy header rather
than a CSP directive, so the directive was dropped and browsers removed it.
Browser support
No current browser supports the referrer directive. Use the Referrer-Policy
header, which is widely supported.
See also
- Directives index
- Evaluate a policy with the CSP evaluator
- Scan a page's security headers
Sources
navigate-to
The CSP navigate-to directive would have restricted navigation targets. It was removed from the spec in 2022 and never shipped in any browser.
require-sri-for
The CSP require-sri-for directive would have required Subresource Integrity on scripts and styles. Use the Integrity-Policy header instead.