diff --git a/htroot/SettingsAck_p.html b/htroot/SettingsAck_p.html index bf4ca7759..cb0c346d1 100644 --- a/htroot/SettingsAck_p.html +++ b/htroot/SettingsAck_p.html @@ -192,7 +192,9 @@ ::

URL Proxy settings have been saved.

:: -

Debug/Analysis settings have been saved.

+

Debug/Analysis settings have been saved.

+ :: +

Referrer policy settings have been saved.

#(/info)#

#(needsRestart)# diff --git a/htroot/SettingsAck_p.java b/htroot/SettingsAck_p.java index 7facc08fc..7e93de68b 100644 --- a/htroot/SettingsAck_p.java +++ b/htroot/SettingsAck_p.java @@ -546,6 +546,18 @@ public class SettingsAck_p { prop.put("info", "34"); return prop; } + + // Referrer Policy settings + if (post.containsKey("referrerPolicySettings")) { + String metaPolicy = post.get("metaPolicy", SwitchboardConstants.REFERRER_META_POLICY_DEFAULT); + env.setConfig(SwitchboardConstants.REFERRER_META_POLICY, metaPolicy); + + boolean tickedCheckbox = post.containsKey("searchResultNoReferrer"); + env.setConfig(SwitchboardConstants.SEARCH_RESULT_NOREFERRER, tickedCheckbox); + + prop.put("info", "35"); + return prop; + } // nothing made prop.put("info", "1");//no information submitted diff --git a/htroot/Settings_Referrer.inc b/htroot/Settings_Referrer.inc new file mode 100644 index 000000000..2c54b55cf --- /dev/null +++ b/htroot/Settings_Referrer.inc @@ -0,0 +1,217 @@ +

Referrer Policy Settings

+ +

+ When loading pages and navigating through links, a web browser sends some information about the origin of the request, +by filling the "Referer" HTTP header. +Visited websites can process this information as they whish, so this can become a privacy concern, for example when coming from a page which contains searched terms in its URL. +

+ +

+ This page offers some configuration settings to instruct your browser how it should fill this referrer information. + Beware that every browser behaves differently : some settings may be unsupported by your particular browser and therefore ignored. + If you are really concerned about privacy, please check what is really sent by your browser by using its embedded developers tools network console, or with the network traffic analyzer of your choice. +

+ +
+
+ Global policy + +

+ This referrer policy applies for every page on this peer. It is set by the "meta" HTML tag. +

+

Values are sorted by decreasing privacy level. + See the related W3C recommendation for full details and available values. +

+ +
+
+
+ +
+
+
+ Highest privacy setting : referrer information should never be sent, even when navigating on this peer internal links. + Be careful with this : some websites might reject requests with no referrer. +
+
+
+
+
+ +
+
+
+ Peer internal links : referrer information should be stripped from any private data and contain only this peer host name.
+ External links : referrer information should never be sent. +
+
+
+
+
+ +
+
+
+ Peer internal and external links : referrer information should be stripped from any private data and contain only this peer host name.
+ Restriction : when a link downgrades from a TLS secured connection (https) on this peer to an unsecured target (http), no referrer information at all should be sent. +
+
+
+
+
+ +
+
+
+ Peer internal and external links : referrer information should be stripped from any private data and contain only this peer host name.
+ Note : this value is also compatible with legacy values from the older specification draft. +
+
+
+
+
+ +
+
+
+ Peer internal links : referrer information should contain full URLs.
+ External links : referrer information should be stripped from any private data and contain only this peer host name.
+ Restriction : when an external link downgrades from a TLS secured connection (https) on this peer to an unsecured target (http), no referrer information at all should be sent. +
+
+
+
+
+ +
+
+
+ Peer internal links : referrer information should contain full URLs.
+ External links : referrer information should be stripped from any private data and contain only this peer host name. +
+
+
+
+
+ +
+
+
+ Referrer information should contain full URLs, except when a link downgrades from a TLS secured connection (https) on this peer to an unsecured target (http). +
+
+
+
+
+ +
+
+
+ Default browser behavior : it should corresponds to "no-referrer-when-downgrade". +
+
+
+
+
+ +
+
+
+ Unsafe setting : referrer information should always contain full URLs. +
+
+ #(metaPolicyCustom)#:: +
+
+
+ +
+
+ +
+ #(/metaPolicyCustom)# +
+ +
+ Search results links + +
+
+
+ +
+
+
+

When checked, this overrides the global referrer policy and adds the standard "noreferrer" + link type to search results links, + thus instructing the browser that it should not send any referrer information at all when visiting them.

+

Be careful with this : some websites might reject requests with no referrer.

+

It is a standard HTML5 attribute value, + supported by much more browsers than the meta tag : if you want a higher level of privacy but use an old or incompatible browser, + this can be a valuable option.

+
+
+
+ +
+ + Changes will take effect immediately. +
+
\ No newline at end of file diff --git a/htroot/Settings_p.html b/htroot/Settings_p.html index 618eb4e49..8892e1422 100644 --- a/htroot/Settings_p.html +++ b/htroot/Settings_p.html @@ -17,6 +17,7 @@