Web/API/HTMLIFrameElement/referrerPolicy

The HTMLIFrameElement.referrerPolicy property reflects the HTML referrerpolicy attribute of the <iframe> element defining which referrer is sent when fetching the resource.

Syntax

refStr = iframeElt.referrerPolicy;
iframeElt.referrerPolicy = refStr;

Values

no-referrer

The Referer header will be omitted entirely. No referrer information is sent along with requests.

no-referrer-when-downgrade (default)

This is the user agent's default behavior if no policy is specified. The URL is sent as a referrer when the protocol security level stays the same (HTTP→HTTP, HTTPS→HTTPS), but isn't sent to a less secure destination (HTTPS→HTTP).

origin

Only send the origin of the document as the referrer in all cases. The document https://example.com/page.html will send the referrer https://example.com/.

origin-when-cross-origin

Send a full URL when performing a same-origin request, but only send the origin of the document for other cases.

same-origin

A referrer will be sent for same-site origins, but cross-origin requests will contain no referrer information.

strict-origin

Only send the origin of the document as the referrer when the protocol security level stays the same (HTTPS→HTTPS), but don't send it to a less secure destination (HTTPS→HTTP).

strict-origin-when-cross-origin

Send a full URL when performing a same-origin request, only send the origin when the protocol security level stays the same (HTTPS→HTTPS), and send no header to a less secure destination (HTTPS→HTTP).

unsafe-url

Send a full URL when performing a same-origin or cross-origin request.

This policy will leak origins and paths from TLS-protected resources to insecure origins. Carefully consider the impact of this setting.

Examples

var iframe = document.createElement("iframe");
iframe.src = "/";
iframe.referrerPolicy = "unsafe-url";
var body = document.getElementsByTagName("body")[0];
body.appendChild(iframe); // Fetch the image using the complete URL as the referrer

Specifications

Specification	Status	Comment
Referrer PolicyThe definition of 'referrerpolicy attribute' in that specification.	Candidate Recommendation	Added the referrerPolicy attribute.
HTML Living StandardThe definition of 'HTMLIFrameElement: referrerPolicy' in that specification.	Living Standard

Browser compatibility

The compatibility table on this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.

Update compatibility data on GitHub

	Desktop						Mobile
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari	Android webview	Chrome for Android	Firefox for Android	Opera for Android	Safari on iOS	Samsung Internet
referrerPolicy	Chrome Full support 51	Edge Full support 79	Firefox Full support 50	IE No support No	Opera Full support 38	Safari Full support 11.1	WebView Android Full support 51	Chrome Android Full support 51	Firefox Android Full support 50	Opera Android Full support 41	Safari iOS No support No	Samsung Internet Android Full support 5.0

Legend

Full support  

Full support

No support  

No support

See also

• HTMLAnchorElement.referrerPolicy, HTMLAreaElement.referrerPolicy, and HTMLAreaElement.referrerPolicy.

HTMLIFrameElement.referrerPolicy by Mozilla Contributors is licensed under CC-BY-SA 2.5.