Should hyperlink downloading consider the referrer policy?

[domfarolino]

It seems like https://html.spec.whatwg.org/multipage/links.html#downloading-hyperlinks doesn't consider the subject's referrerpolicy attribute. Seeing as how both <a> and <area> have this attribute, and it is otherwise respected, it seems reasonable to respect it when downloading things.

Do you agree @annevk?

[annevk]

Yes. I think this is a symptom of #5548. The download attribute bits need to be merged into "follows a hyperlink" and the "navigate" algorithm, instead of being done the way they are.

[domfarolino]

I see, you're saying we should not have a separate path for this, like the current spec has?

[annevk]

Correct, it leads to a number of bugs with redirects and such.

[domenic]

Although I suspect @annevk is right that we should overhaul downloading more thoroughly, this particular issue is tightly scoped enough that someone could make a good contribution on it in isolation. To do so:

• Write web platform tests
  • https://github.com/web-platform-tests/wpt/tree/master/html/semantics/links/downloading-resources supposedly contains tests for this, but for some reason it seems to be testing <a ping>, not downloading? I'm not sure what's up with that; maybe @rwlbuis can comment.
  • The basic idea is similar though: start a download via .click()ing on an <a download>, then ping the server to see what headers were sent, with various referrer policies.
  • Alternately, more exhaustive testing might be possible using the framework in https://github.com/web-platform-tests/wpt/blob/master/common/security-features/README.md ; it seems complicated though.
• If there is agreement, or at least 2/3 browser agreement, on using referrer policy, then proceed to update the spec.
  • This involves updating https://html.spec.whatwg.org/#downloading-hyperlinks 's request creation step to add a referrer policy.
  • An example to consider modeling off of is https://html.spec.whatwg.org/#update-the-image-data
• If there is not agreement, then come back to this thread and report the results. We might just decide to not use referrer policy for downloads and document that in the spec. Or we might try to muster browser representative excitement to change browser behavior to respect referrer policy.