Intermediate LevelAuthentication & Authorization
How do Referrer-Policy headers prevent Authorization Bearer token leakage in GET requests?
❓ Interview Prompt: Explain query parameter token leaks, HTTP Referer headers, Referrer-Policy directives, and security risks.
Passing authentication tokens in URL query parameters ('GET /api/data?token=bearer_xyz') is an anti-pattern. If a user clicks an external link on that page, the browser attaches the full URL (including the query token!) in the outgoing HTTP 'Referer' header to the third-party site.
Mitigations:
1
Never Pass Tokens in Query Parameters: Send tokens in HTTP 'Authorization: Bearer' headers or 'httpOnly' cookies.
2
Enforce Referrer-Policy Header:
'Referrer-Policy: strict-origin-when-cross-origin'
•
Instructs browsers to strip path and query strings when navigating across origins, transmitting only the base origin ('https://company.com').
Code Implementation Example
typescript
// Setting secure Referrer-Policy header via Helmet middleware
import helmet from 'helmet';
app.use(helmet.referrerPolicy({
policy: 'strict-origin-when-cross-origin' // Strips query tokens from Referer headers
}));💡Enforcing strict-origin-when-cross-origin Referrer-Policy header via Helmet.
🎯 Interview Key Takeaway
Set Referrer-Policy to strict-origin-when-cross-origin to prevent URL tokens from leaking via outgoing HTTP Referer headers.
#Referrer-Policy#Token Leakage#Security#HTTP Headers#Intermediate
Back to all Authentication & Authorization Questions→