Quick fix
Remove secrets, credentials, and personal data from URLs wherever possible.
What this finding means
SecuTest accepts restrictive policies such as `strict-origin-when-cross-origin`, `same-origin`, `strict-origin`, or `no-referrer`. It warns when no policy is declared or the value may reveal more information than necessary.
Associated attack or threat scenario
How the attack or failure scenario works
Browsers may send the current page URL in the `Referer` header when navigating or loading third-party resources. If URLs contain identifiers, reset tokens, search terms, or internal paths, that information can leak to external sites and logs.
Conditions and limitations
- A sensitive value appears in a URL or path.
- The page loads or links to another origin.
- The effective referrer policy permits the browser to send the sensitive portion.
Why it matters
Step-by-step fix
Where to make the change
- The outermost component emitting the public HTTP response: CDN, reverse proxy, ingress, web server, or application middleware.
- Apply the control consistently to normal pages, redirects, error responses, and relevant subdomains.
Remediation procedure
- Remove secrets, credentials, and personal data from URLs wherever possible.
- Choose `strict-origin-when-cross-origin` as a balanced baseline or a stricter policy for sensitive applications.
- Set the header consistently at the CDN, reverse proxy, or application middleware.
- Review third-party analytics, payment, support, and embedded resources for compatibility.
Commands and configuration examples
Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Referrer-Policy: no-referrer
Verify the fix
- Run curl and inspect the `Referrer-Policy` header.
- Use browser developer tools to observe the actual `Referer` header on cross-origin requests.
- Test authentication, password reset, checkout, and document-viewing flows.
- Confirm sensitive query strings are not sent to external origins.
After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.
Common mistakes
- Putting reset tokens or API keys in URLs and relying only on the header.
- Using `unsafe-url`, which sends the full URL broadly.
- Setting a meta tag on some pages while API and error responses remain inconsistent.