Description

Detects when web pages are missing the Referrer-Policy HTTP security header. Without this header, sensitive URL information may be leaked when users navigate to other websites, potentially exposing internal paths, session tokens, or other sensitive data in the URL.

Detection Strategy

• Checks only HTML responses from the web application

• Reports a vulnerability if the 'Referrer-Policy' header is missing from the HTTP response headers

• Ignores non-HTML responses (like images, JavaScript, CSS, etc.)