OWASPASVS 5.0 requirement
ASVS-V3.4.5 The application sets a referrer policy to prevent leakage of technically sensitive data to third-party services via the 'referer' http…
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.4 Browser Security Mechanism Headers
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the application sets a referrer policy to prevent leakage of technically sensitive data to third-party services via the 'Referer' HTTP request header field. This can be done using the Referrer-Policy HTTP response header field or via HTML element attributes. Sensitive data could include path and query data in the URL, and for internal non-public applications also the hostname.