On Sat, 31 Dec 2011 19:11:53 +0100, Adam Barth <[email protected]> wrote:
Another concern is what should happen if a request is sent before
finding a meta referrer. For instance:
<head>
<link rel="stylesheet" href="a.css">
<meta name="referrer" content="never">
</head>
In what conditions should the request for the css file be done? Ignore
the meta tag? Wait until the end of <head> in case there would be a meta
element?
The policy for a given network fetch is determined when the fetch is
made. In this case, the request for a.css will include the Referer
header. If you move the <meta> tag above the <link> tag, then the
request will not include the Referer header.
What about:
<head>
<script src="foo.js"></script>
<meta name="referrer" content="never">
<link rel="stylesheet" href="a.css">
</head>
...and the browser speculatively fetches the stylesheet before the <meta>
element is in the DOM? Should the speculative parser have knowledge of
<meta name=referrer>?
"TODO: This algorithm causes the most recently added meta element to
control the referrer-policy. Should we support changing the policy by
setting the content attribute? "
=> I think that allowing to change the policy by setting the content
attribute would be a good idea, but a question can arise regarding what
happens if there are several such <meta> elements in the document.
Yeah. Is there some precedent we should look to here? Perhaps the
<base> element?
Perhaps this should even be an attribute on <base> -- <base referrer="...">
--
Simon Pieters
Opera Software
