Omit referrers on cross-origin requests from an .onion address (fixes #…

…155)
w3c · Nov 9, 2021 · 01399cb · 01399cb
1 parent a5fc841
commit 01399cb
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/index.src.html b/index.src.html
@@ -848,6 +848,12 @@ <h3 id="determine-requests-referrer" dfn export>
       Let request's <dfn>referrerURL</dfn> be the result of <a href="#strip-url">stripping
       <var>referrerSource</var> for use as a referrer.</a>
     </li>
+    <li>
+      If the <a for=url>origin</a> of <a>referrerURL</a> is using the <code>.onion</code>
+      special-use domain name defined in [[!RFC7686]] and is not <a lt="same origin">the
+      same</a> as the <a for=url>origin</a> of <var>request</var>'s <a for=request>current
+      URL</a>, then return <code>no referrer</code>.
+    </li>
     <li>
       Let <var>referrerOrigin</var> be the result of
       <a href="#strip-url">stripping <var>referrerSource</var> for use as a