I'd not heard of this.

But on reading it closely, I don't think it regulates the referer header, rather it prevent restricts the origins of resources that a page can load.So it doesn't work with referrer policies. but I could be wrong

Eric

On Jun 12, 2015, at 12:24 AM, Conal Tuohy <[log in to unmask]> wrote:
> 
> Assuming your library web server has a front-end proxy (I guess this is
> pretty common) or at least runs inside Apache httpd or something, then
> rather than use the HTML meta tag, it might be easier to set the "referer"
> policy via the "Content-Security-Policy" HTTP header field.
> 
> https://w3c.github.io/webappsec/specs/content-security-policy/#content-security-policy-header-field
> 
> e.g. in Apache httpd with mod_headers:
> 
> Header set Content-Security-Policy referrer 'no-referrer'
> 
> 
>