Skip to content

fix: send Referer header for strict-origin referrer policy - #1912

Closed
marceli1404 wants to merge 1 commit into
node-fetch:mainfrom
marceli1404:fix/strict-origin-referrer-header
Closed

marceli1404 wants to merge 1 commit into
node-fetch:mainfrom
marceli1404:fix/strict-origin-referrer-header

Conversation

@marceli1404

Copy link
Copy Markdown

Bug: The Referer header is never sent when referrerPolicy strict-origin is used, even though the spec requires it when referrer URL and current URL are both potentially trustworthy.

Root cause: in determineRequestsReferrer (src/utils/referrer.js), the strict-origin case returns referrerOrigin.toString() (a String), while every other policy returns the URL object. The header is sent from getNodeRequestOptions only when request referrer is instanceof URL, so the string fails the check and the Referer header is dropped.

Fix: return the referrerOrigin URL object in the strict-origin case, matching the spec step and every other policy.

Verification:

  • New integration regression test fails on unpatched code (expected undefined) and passes with the fix.
  • Full test/referrer.js suite: 121 passing.
  • test/request.js + test/response.js + test/headers.js: 63 passing.
  • The 3 failing test/main.js cases are pre-existing environment issues (chunked-timing flakes + deprecated agent family option), unrelated to this change.

@marceli1404 marceli1404 closed this by deleting the head repository Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant