Block sending Referrer information

[Erikuio]

to improve user privacy (like the other Things webrtc, Hyperlink, csp...)

for Firefox (about:config)
Normal Modus: network.http.referer.defaultPolicy (Standard = 3)
Private Modus: network.http.referer.defaultPolicy.pbmode (Standard = 2)

From version 53 onwards, Gecko has a pref available in about:config to allow users to set their default Referrer-Policy— network.http.referer.userControlPolicy.
From version 59 onwards (See #587523), this has been replaced by network.http.referer.defaultPolicy and network.http.referer.defaultPolicy.pbmode.
-> https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy

Chrome etc i dont know.

greetings

[huubert]

You could already do this by setting network.http.referer.XOriginPolicy to 2.
I've been using it for months and it didn't break any sites yet.

[anewuser]

Blocking referrers for third-party domains by default is great for improving your privacy, but breaks some websites.

AdGuard maintains whitelist filters to unbreak them: the lines with $stealth=referrer or $stealth with no parameters.

[gorhill]

If I implemented something for referrer control, I would rather just add a referrer= option, which value would just be one of the documented Referrer-Policy values (above the default one): https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy

[anewuser]

If this is implemented, we can ask AdGuard to convert those @@ filters to referrer=strict-origin-when-cross-origin for uBlock Origin users. They are currently removed altogether from adguard-generic.

This would allow uBlock Origin users to add a generic filter like $3p,referrer=same-origin to have the same protection as AdGuard's Hide Referer from third parties option, while benefiting from their actively maintained list of exceptions.

Removing referrers for same-domain cross-origin requests ($referrer=same-origin) would require additional exceptions to unbreak, for example, download buttons on the AMD website ($referrer=strict-origin-when-cross-origin,to=amd.com,from=amd.com). We can submit such exceptions to uBlock filters – Privacy.

The generic filters I've mentioned are meant to be set up manually by advanced users, of course, but maybe uBlock filters – Privacy could also start including specific filters to hide referrers from big CDNs that don't require them, like ajax.googleapis.com.