referrerPolicy unsafe-url is not being respected
Open
Nobody has claimed this yet.
bug
- Dominant language
- JavaScript
- Stars
- 7.7k
- Forks
- 880
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 68
Description
Bug Description
referrerPolicy unsafe-url is not being respected
Reproducible By
fetch('https://example.com', {
referrer: 'https://google.com/hello/world',
referrerPolicy: 'unsafe-url'
});
- request ends up with header
referer: https://google.com/(path is removed)
Expected Behavior
- request has header
referer: https://google.com/hello/world
Environment
MacOS 14.7, Node v20
Additional context
- logic in
determineRequestsReferrerlooks good, which suggests something else is modifyingreferrer - why does this code exist? it appears to forcefully block cross-origin referrers, regardless of policy: https://github.com/nodejs/undici/blob/02c61d2612953ab810457340762579aef7f78b0f/lib/web/fetch/request.js#L280-L292
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the fetch example, then inspect lib/web/fetch/request.js around the linked lines 280-292 and the determineRequestsReferrer logic. Trace where the cross-origin referrer path is removed and verify that the request sends the full https://google.com/hello/world path under unsafe-url.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100