Mar 10, 2018 · Referer Control grants full control over the HTTP Referer. You can forge any referrer you want, both globally or on a per-site basis. Alternatively you can choose to disable the Referer completely.
Referer is a header sent and controlled by the client. You cannot trust any data coming unchecked from the client. As others pointed out, it can be easily manipulated. Quickly and easily assess the security of your HTTP response headers External CSS stylesheets use the default policy (no-referrer-when-downgrade) unless it's overwritten via an HTTP header that is set for a CSS stylesheet specifically. For inline styles or styles created from APIs like HTMLElement.style , the owner document's referrer policy is used. The HTTP referer is an optional HTTP header field that identifies the address of the webpage which is linked to the resource being requested. By checking the referrer, the new webpage can see
The Referer header also will not be sent when the link is from a non-HTTP(S) protocol, such as file://, to another page. More Information The Referer header is a standard HTTP header in the form of "Referer: ," which indicates to a Web server the URL of the page …
A new security header: Referrer Policy Feb 17, 2017
Config Element - "HTTP Header Manager" - PerfMatrix
Security/Referrer - MozillaWiki