Referrer-Policy updated

andreasschulze · Mar 27, 2024 · cd96e31 · cd96e31
1 parent faf83c4
commit cd96e31
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## main
+
+- Referrer-policy changed to 'no-referrer' as suggested by internet.nl
+
 ## 2.3.0
 
 - RFC 9116 support

diff --git a/scmdhttpd.go b/scmdhttpd.go
@@ -201,7 +201,7 @@ func main() {
 				w.Header().Add("Content-Security-Policy", "default-src 'none';img-src 'self';style-src 'self';form-action 'none';base-uri 'self';frame-ancestors 'none';upgrade-insecure-requests;")
 				w.Header().Add("X-Xss-Protection", "0")
 				w.Header().Add("X-Frame-Options", "DENY")
-				w.Header().Add("Referrer-Policy", "strict-origin-when-cross-origin")
+				w.Header().Add("Referrer-Policy", "no-referrer")
 				w.Header().Add("X-Content-Type-Options", "nosniff")
 				w.Header().Add("Expect-Ct", "max-age=6048000,enforce")