liveBook · Manning

Referrer policy

As explained in Building Web APIs with ASP.NET Core

An HTTP security policy that controls whether and how much referrer URL information a browser sends with requests.

A referrer policy controls whether a browser sends the URL of the page that linked to a requested resource in the Referer HTTP header. Without an explicit value, the default behavior strips referrer information when moving from HTTPS to unsecure HTTP but preserves it in other cases. section 12.1.4

Configure the policy as an HTTP response header in Program.cs. Custom middleware adds this header alongside other security headers, while HSTS uses its own built-in middleware. Apply these headers only outside development so protections such as HSTS do not complicate localhost testing. section 12.1.4

How Building Web APIs with ASP.NET Core covers it

How deep it goes
Defines the header’s behavior and places it in middleware, but defers detailed policy configuration and security-header theory.
Examples
Uses a Program.cs middleware listing that adds Referrer-Policy alongside several security response headers outside development.
What it assumes
Assumes familiarity with HTTP response headers and application middleware while defining referrer information and default browser behavior.
What you can do after
Operate/configure a web API’s Referrer-Policy response header through custom middleware in nondevelopment environments.
How it connects
Connects referrer policy with HTTP security headers, HSTS, Content Security Policy, and browser request behavior.
Cover of Building Web APIs with ASP.NET Core
liveBookmanning.com
Read Building Web APIs with ASP.NET Core on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Building Web APIs with ASP.NET Core. The section links point to the parts of the book it draws on.