LEARNING OBJECTIVES ⌵
- Understand the HTTP
Referer(historical misspelling) request header. - Identify critical privacy leakage risks (Session tokens, user IDs, reset tokens in URL query strings).
- Learn the default browser Referrer Policy (
strict-origin-when-cross-origin). - Protect sensitive intranet and application URLs from third-party analytics leakage.
🎬 INTERACTIVE VISUAL PIPELINE
Core Architecture Simulation
1. Input
Directives & Tags
2. Parse
Tokenizer & AST
3. Layout
Box Model & Flow
4. Render
GPU Paint & Composite
PHASE 1: INPUT & DIRECTIVES
Browser receives declarative markup stream, parsing tag tokens and initializing component state.
📖 The Privacy Leakage Threat Model
Imagine a user receives a password reset link:
https://app.com/reset-password?token=secret_abc_123
If that password reset page contains an embedded third-party script, image, or external support link, the user's browser automatically includes the full URL in the Referer header sent to that third-party:
Referer: https://app.com/reset-password?token=secret_abc_123
The third-party server now has the user's private password reset token!
Referrer Policy gives website developers strict control over how much URL information is shared with destination servers.
📌 Key Takeaways
- Never put sensitive credentials or PII in URL query parameters.
- Referrer Policy prevents the browser from leaking full path and query string details across origin boundaries.
- --
❓ Knowledge Check
1. Which of the following is correct?
2. Which of the following is correct?