The W3C has recently added tests [1] under the Web Platform Test Runner that checks and ensures that browsers are not using the CSP "referrer" directive to set a Referrer Policy which has been replaced by the Referrer-Policy header [2]. Chris, would removing the CSP "referrer" directive cause any compatibility issues? Is the directive still widely used in the web? [1] https://w3c-test.org/referrer-policy/generic/unsupported-csp-referrer-directive.html [2] https://github.com/w3c/web-platform-tests/pull/3416

Hey Kamil, I suppose the least we can do is a log a warning to the console that it's deprecated and also get some telemetry data (somewhere around here [1]). If not too many pages rely on it, I am fine with removing the code from CSP. But I suppose we should wait at least 2 cycles to give folks a chance to switch and use the Referrer-Policy header. Agreed? [1] https://dxr.mozilla.org/mozilla-central/source/dom/security/nsCSPParser.cpp#867

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #1) > Hey Kamil, I suppose the least we can do is a log a warning to the console > that it's deprecated and also get some telemetry data (somewhere around here > [1]). If not too many pages rely on it, I am fine with removing the code > from CSP. But I suppose we should wait at least 2 cycles to give folks a > chance to switch and use the Referrer-Policy header. Agreed? > > [1] > https://dxr.mozilla.org/mozilla-central/source/dom/security/nsCSPParser. > cpp#867 Completely agreed :)

Looks like this is removed in Chrome 56 https://bugs.chromium.org/p/chromium/issues/detail?id=658761

I'm not sure this is enough. ... and I still have to see how many WPTs are broken by this patch.

Comment on attachment 8973696 [details] [diff] [review] csp_referrer.patch Review of attachment 8973696 [details] [diff] [review]: ----------------------------------------------------------------- that looks good to me, thanks and r=me!

Pushed by amarchesini@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/eeaae6812d82 Remove the "referrer" directive in CSP, r=ckerschb

Posted the site compatibility note: https://www.fxsitecompat.com/en-CA/docs/2018/csp-referrer-directive-has-been-removed/

https://developer.mozilla.org/en-US/Firefox/Releases/62#HTTP https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/referrer https://github.com/mdn/browser-compat-data/pull/2369