Summary

Netsparker detected that the Referrer-Policy is defined empty.

Impact

In the situation that the Referrer-Policy is defined empty, the fallback mechanism comes into play and the Referer information will be controlled by meta or rel attribute of each parameter from which traffics originated to cross-sites.

Remediation

Please take into consideration that dynamically added URL into site context and also add adequate control for the current HTML-elements by using alternatives below --if these controls cause cross-site requests:

<meta name="referrer" value=""/>
<img referrerpolicy="" src=""/>
<a href referrerpolicy="" href=""></a>
<a href rel="" href=""></a>
Classifications
OWASP PC-C9, OWASP 2013-A6
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities

Select Category

OR

Search Vulnerability

Netsparker

Dead accurate, fast & easy-to-use Web Application Security Scanner

GET A DEMO