1433352 - window.open() needs to support referrerpolicy

Status: NEW

(Core :: DOM: Security, enhancement, P3)

Description

[Daniel Veditz [:dveditz]]

window.open() does not appear to support referrerpolicy. Haven't looked up what the spec says but given Referrer Policy for pages and referrerpolicy attribute for links and fetch() it really needs to do so. Seems a natural for the third "Windows Features" argument to window.open().

Comment 1

[Jonathan Kingston [:jkt] he/him]

Looks to me like the hook into the HTML spec suggests it should change a navigation: https://www.w3.org/TR/referrer-policy/#integration-with-html

The HTML spec says:
"The open(url, target, features) method on Window objects provides a mechanism for navigating an existing browsing context or opening and navigating an auxiliary browsing context."

Comment 2

[Anne (:annevk)]

So you want to override the document's referrer policy with a new referrerpolicy feature for window.open(), similar to how you can override it on <img> with a referrerpolicy attribute?

Or do you mean that window.open() should use the document's referrer policy?

If the former, it seems we should work with other browsers on standardizing that approach first. (Somewhat related: we're still dealing with fallout from adding noopener as a feature for window.open().)

Comment 3

[Daniel Veditz [:dveditz]]

I assume window.open() _already_ follows the document's referrer policy. If it does not that's clearly a bug and a hole in our referrerpolicy implementation.

Since we've found it useful to override the document's referrer policy in may other cases, including the analogous ways of opening a "popup" then adding it to window.open() seems appropriate. Yes, we should attempt to standardize this.

Comment 4

[Tanvi Vyas[:tanvi]]

Dan, are you saying that window.open doesn't support the user set about:config referrer policy, or does not respect the referrer policy set by the parent document?  If the former, then that seems pretty bad to me.

Comment 5

[Anne (:annevk)]

He means that you cannot control it for window.open() the way you can with <img referrerpolicy=...>.