Respect Referrer-Policy header

Provide the steps to reproduce

1. Run LH on https://laukstein.com/web/2011-tippers-widget

What is the current behavior?

LH recommendation for external links while has header Referrer-Policy: no-referrer

Add rel="noopener" or rel="noreferrer" …

What is the expected behavior?

If page has Referrer-Policy: no-referrer (spec https://w3c.github.io/webappsec-referrer-policy/) it expected to behavior as all links having rel="noreferrer" and not expected LH to specify it also as HTML attribute. Know that perhaps other Referrer-Policy values like same-origin, etc. must also fix this issue.

Environment Information

• Affected Channels: Extension
• Lighthouse version: 3.0.3
• Operating System: Win10 64-bit

[patrickhulce]

@laukstein the purpose of the audit is to prevent the global opener property, not to avoid the Referrer header being sent. We really don’t care either way if the Referrer header is sent.

The spec you’ve linked to that @brendankenny quoted does not say that rel="noreferrer" is equivalent to Referrer-Policy: no-referrer. It says that Referrer-Policy: no-referrer will not send the referrer header and makes no mention of the opener property like rel="noreferrer" does.

because it is not something Lighthouse says, but instead:

The title of the audit communicates this with Links to cross-origin destinations are safe, while Referrer may leak information, it’s not inherently unsafe like opener is. The extended description that mentions rel="noreferrer" is indicating one of the ways to accomplish this goal. Referrer-Policy: no-referrer does not appear to be a spec-approved way of accomplishing this goal, so we shouldn’t be checking for it.

[laukstein]

cc @patrickhulce @brendankenny Attribute rel="noreferrer" delivers same result Referrer-Policy: no-referrer (only with header it aplies globally for all links) as is said in spec https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer:

… would send no Referer header

I disagree with

Since the audit goal is noopener behavior and not just to not have a referrer, I believe we should close this issue.

because it is not something Lighthouse says, but instead:

Add rel="nooper" or rel="noreferrer"