Check · Browser protection · default severity low
Referrer-Policy
What Kavach checks
Controls how much of your URL is leaked when users click away.
Why it matters
Without it, full URLs (which may contain tokens or IDs) leak to third-party sites in the Referer header.
How an attacker uses it
- A user clicks an external link from a page whose URL holds a token.
- The full URL, token included, is sent to that third party.
How to fix it
Add: Referrer-Policy: strict-origin-when-cross-origin
Stack-specific fixes: nginx · Apache · Caddy · Express / Node · Cloudflare
Limitations
This is a read-only observation of publicly reachable configuration at scan time. It can produce false positives/negatives (caching layers, geo-specific responses, bot defences) and does not test application logic or authenticated areas. Rule version 1.