Reviewing methods for not passing referrer

[JorgeV]

Hello,

Please correct me, if I am wrong.

If a web site does NOT want to pass referrer for both internal and external links, I see 3 possibles methods :

1- Set the Server Header :

Referrer-Policy: no-referrer

All links, internal/external will not pass referrer.

2- Set the meta tag :

<meta name="referrer" content="no-referrer">

Same effect as above.

3- Tag each individual link, with the attribute:

rel=”noopener noreferrer”

Am I right?

Thank you.

[phranque]

you can also do this "Via a referrerpolicy content attribute on an a, area, img, iframe, link, or script element."

see:
https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-referrer-attribute

[JorgeV]

Hello,

Indeed I missed this one !