Referrer-Policy Header Builder
Referrer-Policy Header Builder: Validates W3C Referrer Policy specification directives and outputs standard HTTP response header.
About this referrer-policy header builder
Validates W3C Referrer Policy specification directives and outputs standard HTTP response header Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Decodes, inspects, and validates authentication tokens and cryptographic credentials conforming to RFC 7519 (JSON Web Token - JWT), RFC 7515 (JSON Web Signature - JWS), and RFC 6238 (TOTP: Time-Based One-Time Password Algorithm). Decodes Base64URL-encoded JWT headers and claims payloads into syntax-highlighted JSON, parsing UNIX timestamps (iat, exp, nbf) into human-readable UTC dates and evaluating token expiration status without exposing private signing keys.
Worked verification example
Scenario: Build the documented matrix for strict-origin-when-cross-origin.
Sample input:
Processing: Validate one of eight allowed directives and render HTTP header, meta tag, and three-context matrix.
Illustrative output:
Security parameters & input constraints
Only the eight hard-coded policy tokens are accepted; spelling or extra values are rejected. The matrix is a simplified static summary, not a live browser request, redirect test, or proof of privacy behavior for a deployed site.
Cryptographic digests, encoded strings, and signatures generated by Referrer-Policy Header Builder should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in Referrer-Policy Header Builder execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
Referrer-Policy Header Builder verification · Audit standards
How to use it
- Enter one supported Referrer-Policy token, or leave the input empty for strict-origin-when-cross-origin.
- Run locally to build the header, meta element, and same-origin/cross-origin/downgrade summary.
- Read or copy the JSON and review its matrix before using a policy on a site.
Frequently asked questions
Which Referrer-Policy values are accepted?+
The primary text accepts exactly eight recognized directives, including no-referrer, origin, same-origin, strict-origin and strict-origin-when-cross-origin; blank input defaults to strict-origin-when-cross-origin.
What does the page generate?+
It emits the selected policy, an HTTP Referrer-Policy header, a meta tag, and a same-origin/cross-origin/downgrade matrix showing whether the page model sends a full URL, origin, or none.
What example can I run locally?+
For strict-origin-when-cross-origin, returned its matching header, full URL for same origin, origin for cross origin, and none on downgrade. This validates the page’s local matrix for that directive.
What cannot this matrix guarantee?+
It does not inspect a live navigation, browser extensions, redirects, element referrerpolicy attributes, server headers, user-agent quirks, or other controls that can alter an actual request.