many browers not support this header. but it's future ~

@stefansundin Thanks for creating this.

The Chrome issue you linked to has since been marked fixed.

Implement new referrer policies

This CL implements the policies 'same-origin' and 'strict-origin', and
repurposes existing logic that was previously only available behind a flag for
'strict-origin-when-cross-origin'. (I've left it as a TODO for a follow-up
to rename this policy to match the spec.)

Existing web platform tests cover the new policies and should now pass.

Intent to Implement and Ship:
https://groups.google.com/a/chromium.org/d/msg/blink-dev/TgtPUowSWuU/Y-Sn2oRsCAAJ

Does that fact change any of your earlier assessment of the mergeability of this change?

That note in the issue is confusing to say the least. Anyway, when Chrome 61 ships, it will be easy to test if the default value works as expected.

Let's wait for chrome 61 to test this then. My reading of this seems to be that this name is only temporary? And will likely change to match the spec? Not sure which spec they're... referring to here tho :)

This post suggests that the policy name hasn't changed: https://blog.chromium.org/2017/08/chrome-61-beta-javascript-modules.html

I think the note was talking about renaming something internally. But we can still wait.

@zzak I think this can merged now. :)

Thanks @stefansundin, I think at some point we may want to circle back and enable this protection by default.