Description

Detects when web pages are missing the Referrer-Policy HTTP security header. Without this header, sensitive URL information may be leaked when users navigate to other websites, potentially exposing internal paths, session tokens, or other sensitive data in the URL.

Detection Strategy

• Checks only HTML responses from the web application

• Reports a vulnerability if the 'Referrer-Policy' header is missing from the HTTP response headers

• Reports a vulnerability if the 'Referrer-Policy' header has no known policy value, since the browser default applies

• Ignores non-HTML responses (like images, JavaScript, CSS, etc.)