* Determine request’s Referrer * * @see https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer
(request)
| 379 | * @see https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer |
| 380 | */ |
| 381 | function determineRequestsReferrer (request) { |
| 382 | // Given a request request, we can determine the correct referrer information |
| 383 | // to send by examining its referrer policy as detailed in the following |
| 384 | // steps, which return either no referrer or a URL: |
| 385 | |
| 386 | // 1. Let policy be request's referrer policy. |
| 387 | const policy = request.referrerPolicy |
| 388 | |
| 389 | // Note: policy cannot (shouldn't) be null or an empty string. |
| 390 | assert(policy) |
| 391 | |
| 392 | // 2. Let environment be request’s client. |
| 393 | |
| 394 | let referrerSource = null |
| 395 | |
| 396 | // 3. Switch on request’s referrer: |
| 397 | |
| 398 | // "client" |
| 399 | if (request.referrer === 'client') { |
| 400 | // Note: node isn't a browser and doesn't implement document/iframes, |
| 401 | // so we bypass this step and replace it with our own. |
| 402 | |
| 403 | const globalOrigin = getGlobalOrigin() |
| 404 | |
| 405 | if (!globalOrigin || globalOrigin.origin === 'null') { |
| 406 | return 'no-referrer' |
| 407 | } |
| 408 | |
| 409 | // Note: we need to clone it as it's mutated |
| 410 | referrerSource = new URL(globalOrigin) |
| 411 | // a URL |
| 412 | } else if (webidl.is.URL(request.referrer)) { |
| 413 | // Let referrerSource be request’s referrer. |
| 414 | referrerSource = request.referrer |
| 415 | } |
| 416 | |
| 417 | // 4. Let request’s referrerURL be the result of stripping referrerSource for |
| 418 | // use as a referrer. |
| 419 | let referrerURL = stripURLForReferrer(referrerSource) |
| 420 | |
| 421 | // 5. Let referrerOrigin be the result of stripping referrerSource for use as |
| 422 | // a referrer, with the origin-only flag set to true. |
| 423 | const referrerOrigin = stripURLForReferrer(referrerSource, true) |
| 424 | |
| 425 | // 6. If the result of serializing referrerURL is a string whose length is |
| 426 | // greater than 4096, set referrerURL to referrerOrigin. |
| 427 | if (referrerURL.toString().length > 4096) { |
| 428 | referrerURL = referrerOrigin |
| 429 | } |
| 430 | |
| 431 | // 7. The user agent MAY alter referrerURL or referrerOrigin at this point |
| 432 | // to enforce arbitrary policy considerations in the interests of minimizing |
| 433 | // data leakage. For example, the user agent could strip the URL down to an |
| 434 | // origin, modify its host, replace it with an empty string, etc. |
| 435 | |
| 436 | // 8. Execute the switch statements corresponding to the value of policy: |
| 437 | switch (policy) { |
| 438 | case 'no-referrer': |
no test coverage detected