Limit `Referer` header's length to 4k

Category: Security
Type: New or changed feature
Status: Enabled by default (Chrome 77)
Intent stage: Evaluate readiness to ship

Breaking change: No
Enterprise impact: None
Spec maturity: Incubation
Web Platform Tests: Yes

WPT details: The existing `referrer-policy` tests are extended in https://chromium-review.googlesource.com/c/chromium/src/+/1646784 (https://github.com/web-platform-tests/wpt/pull/17204) to cover the length limitation.

Summary

Strips the Referer header down to an origin when it's size exceeds 4k.

Motivation

As noted in https://github.com/xsleaks/xsleaks/wiki/Browser-Side-Channels#cache-and-error-events, servers will often behave in unexpected ways when presented with an overly-long `Referer` header. This is unfortunate, as `Referer` is one header whose length attackers generally retain control over when generating `no-cors` requests.

Standards & signals

Specification: https://github.com/w3c/webappsec-referrer-policy/pull/122
Firefox: Positive
Safari: No signal
Web developers: No signals
Tracking bug: https://bugs.chromium.org/p/chromium/issues/detail?id=959757

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=limit-referer-header-s-length-to-4k
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Limit%20%60Referer%60%20header's%20length%20to%204k
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Limit%20%60Referer%60%20header's%20length%20to%204k
Baseline status: https://webstatus.dev/?q=Limit%20%60Referer%60%20header's%20length%20to%204k

Docs: https://github.com/whatwg/fetch/issues/903

Explainers: https://github.com/whatwg/fetch/issues/903

View on chromestatus.com