Referrer-Policy Needs Proper Fallback
Summary#
Invicti detected that the Referrer-Policy is defined empty.
Impact#
In the situation that the Referrer-Policy is defined empty, the fallback mechanism comes into play and the Referer information will be controlled by meta or rel attribute of each parameter from which traffics originated to cross-sites.
Remediation#
Please take into consideration that dynamically added URL into site context and also add adequate control for the current HTML-elements by using alternatives below --if these controls cause cross-site requests:
<meta name="referrer" value=""/>
<img referrerpolicy="" src=""/>
<a href referrerpolicy="" href=""></a>
<a href rel="" href=""></a>
Classifications#
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
Tags
Related Vulnerabilities
