govdirectory.org should set the Referrer-Policy header

[Abbe98]

The feature

No external sites we link to should be allowed to see the origin of a user following the link. Therefore, Referrer-Policy should be set to no-referrer.

Why?

For privacy reasons.

Examples and inspiration

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy

Notes

Because we serve Govdirectory from the Github CDN we can't set custom headers so this tasked is blocked by #33.

[objectofmind]

Hi! Can I work on this? I see that it's a "good first issue" and I would like to use this opportunity to fix this issue.

[RVA2869]

@Abbe98 Is this issue still relevant? Apparently (since October 2021) if there is no explicit header present, the default policy is applied. Which is <meta name="referrer" content="strict-origin-when-cross-origin">

[Abbe98]

No if that's the case we can close this!

[RVA2869]

No if that's the case we can close this!

@Abbe98
https://web.dev/articles/referrer-best-practices#default
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#strict-origin-when-cross-origin

[Abbe98]

Amazing!