{
  "specification": [
    {
      "name": "unset-referrer-policy",
      "title": "Referrer Policy is not explicitly defined",
      "description": "Check that referrer URL follows no-referrer-when-downgrade policy when no explicit Referrer Policy is set.",
      "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policies",
      "referrer_policy": null,
      "test_expansion": [
        {
          "name": "insecure-protocol",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "upgrade-protocol",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "downgrade-protocol",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "omitted"
        },
        {
          "name": "secure-protocol",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        }
      ]
    },
    {
      "name": "no-referrer",
      "title": "Referrer Policy is set to 'no-referrer'",
      "description": "Check that sub-resource never gets the referrer URL.",
      "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer",
      "referrer_policy": "no-referrer",
      "test_expansion": [
        {
          "name": "generic",
          "expansion": "default",
          "source_protocol": "*",
          "target_protocol": "*",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "omitted"
        }
      ]
    },
    {
      "name": "no-referrer-when-downgrade",
      "title": "Referrer Policy is set to 'no-referrer-when-downgrade'",
      "description": "Check that non a priori insecure subresource gets the full Referrer URL. A priori insecure subresource gets no referrer information.",
      "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer-when-downgrade",
      "referrer_policy": "no-referrer-when-downgrade",
      "test_expansion": [
        {
          "name": "insecure-protocol",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "upgrade-protocol",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "downgrade-protocol",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "omitted"
        },
        {
          "name": "secure-protocol",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        }
      ]
    },
    {
      "name": "origin",
      "title": "Referrer Policy is set to 'origin'",
      "description": "Check that all subresources in all casses get only the origin portion of the referrer URL.",
      "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin",
      "referrer_policy": "origin",
      "test_expansion": [
        {
          "name": "generic",
          "expansion": "default",
          "source_protocol": "*",
          "target_protocol": "*",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "origin"
        }
      ]
    },
    {
      "name": "same-origin",
      "title": "Referrer Policy is set to 'same-origin'",
      "description": "Check that cross-origin subresources get no referrer information and same-origin get the stripped referrer URL.",
      "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-same-origin",
      "referrer_policy": "same-origin",
      "test_expansion": [
        {
          "name": "same-origin-insecure",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "same-origin-secure-default",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "same-origin-insecure",
          "expansion": "override",
          "source_protocol": "*",
          "target_protocol": "*",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "swap-origin-redirect",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "omitted"
        },
        {
          "name": "cross-origin",
          "expansion": "default",
          "source_protocol": "*",
          "target_protocol": "*",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "cross-origin",
          "subresource": "*",
          "referrer_url": "omitted"
        }
      ]
    },
    {
      "name": "origin-when-cross-origin",
      "title": "Referrer Policy is set to 'origin-when-cross-origin'",
      "description": "Check that cross-origin subresources get the origin portion of the referrer URL and same-origin get the stripped referrer URL.",
      "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin-when-cross-origin",
      "referrer_policy": "origin-when-cross-origin",
      "test_expansion": [
        {
          "name": "same-origin-insecure",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "same-origin-secure-default",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "same-origin-upgrade",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "origin"
        },
        {
          "name": "same-origin-downgrade",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "origin"
        },
        {
          "name": "same-origin-insecure",
          "expansion": "override",
          "source_protocol": "*",
          "target_protocol": "*",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "swap-origin-redirect",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "origin"
        },
        {
          "name": "cross-origin",
          "expansion": "default",
          "source_protocol": "*",
          "target_protocol": "*",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "cross-origin",
          "subresource": "*",
          "referrer_url": "origin"
        }
      ]
    },
    {
      "name": "strict-origin",
      "title": "Referrer Policy is set to 'strict-origin'",
      "description": "Check that non a priori insecure subresource gets only the origin portion of the referrer URL. A priori insecure subresource gets no referrer information.",
      "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin",
      "referrer_policy": "strict-origin",
      "test_expansion": [
        {
          "name": "insecure-protocol",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "origin"
        },
        {
          "name": "upgrade-protocol",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "origin"
        },
        {
          "name": "downgrade-protocol",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "omitted"
        },
        {
          "name": "secure-protocol",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "origin"
        }
      ]
    },
    {
      "name": "strict-origin-when-cross-origin",
      "title": "Referrer Policy is set to 'strict-origin-when-cross-origin'",
      "description": "Check that a priori insecure subresource gets no referrer information. Otherwise, cross-origin subresources get the origin portion of the referrer URL and same-origin get the stripped referrer URL.",
      "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin-when-cross-origin",
      "referrer_policy": "strict-origin-when-cross-origin",
      "test_expansion": [
        {
          "name": "same-insecure",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "same-insecure",
          "expansion": "override",
          "source_protocol": "http",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "swap-origin-redirect",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "origin"
        },
        {
          "name": "cross-insecure",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "cross-origin",
          "subresource": "*",
          "referrer_url": "origin"
        },
        {
          "name": "upgrade-protocol",
          "expansion": "default",
          "source_protocol": "http",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "origin"
        },
        {
          "name": "downgrade-protocol",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "http",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "omitted"
        },
        {
          "name": "same-secure",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        },
        {
          "name": "same-secure",
          "expansion": "override",
          "source_protocol": "https",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "swap-origin-redirect",
          "origin": "same-origin",
          "subresource": "*",
          "referrer_url": "origin"
        },
        {
          "name": "cross-secure",
          "expansion": "default",
          "source_protocol": "https",
          "target_protocol": "https",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "cross-origin",
          "subresource": "*",
          "referrer_url": "origin"
        }
      ]
    },
    {
      "name": "unsafe-url",
      "title": "Referrer Policy is set to 'unsafe-url'",
      "description": "Check that all sub-resources get the stripped referrer URL.",
      "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-unsafe-url",
      "referrer_policy": "unsafe-url",
      "test_expansion": [
        {
          "name": "generic",
          "expansion": "default",
          "source_protocol": "*",
          "target_protocol": "*",
          "delivery_method": ["http-rp", "meta-referrer", "attr-referrer"],
          "redirection": "*",
          "origin": "*",
          "subresource": "*",
          "referrer_url": "stripped-referrer"
        }
      ]
    }
  ],

  "excluded_tests":[
    {
      "name": "cross-origin-workers",
      "expansion": "*",
      "source_protocol": "*",
      "target_protocol": "*",
      "redirection": "*",
      "delivery_method": "*",
      "origin": "cross-origin",
      "subresource": [
        "worker-request",
        "module-worker",
        "shared-worker"
      ],
      "referrer_url": "*"
    },
    {
      "name": "upgraded-protocol-workers",
      "expansion": "*",
      "source_protocol": "http",
      "target_protocol": "https",
      "delivery_method": "*",
      "redirection": "*",
      "origin": "*",
      "subresource": [
        "worker-request",
        "module-worker",
        "shared-worker"
      ],
      "referrer_url": "*"
    },
    {
      "name": "mixed-content-insecure-subresources",
      "expansion": "*",
      "source_protocol": "https",
      "target_protocol": "http",
      "delivery_method": "*",
      "redirection": "*",
      "origin": "*",
      "subresource": "*",
      "referrer_url": "*"
    },
    {
      "name": "elements-not-supporting-attr-referrer",
      "expansion": "*",
      "source_protocol": "*",
      "target_protocol": "*",
      "delivery_method": ["attr-referrer"],
      "redirection": "*",
      "origin": "*",
      "subresource": [
        "xhr-request",
        "worker-request",
        "module-worker",
        "shared-worker",
        "fetch-request"
      ],
      "referrer_url": "*"
    },
    {
      "name": "elements-not-supporting-rel-noreferrer",
      "expansion": "*",
      "source_protocol": "*",
      "target_protocol": "*",
      "delivery_method": ["rel-noreferrer"],
      "redirection": "*",
      "origin": "*",
      "subresource": [
        "iframe-tag",
        "img-tag",
        "script-tag",
        "xhr-request",
        "worker-request",
        "module-worker",
        "shared-worker",
        "fetch-request",
        "area-tag"
      ],
      "referrer_url": "*"
    },
    {
      "name": "area-tag",
      "expansion": "*",
      "source_protocol": "*",
      "target_protocol": "*",
      "delivery_method": "*",
      "redirection": "*",
      "origin": "*",
      "subresource": "area-tag",
      "referrer_url": "*"
    },
    {
      "name": "worker-requests-with-swap-origin-redirect",
      "expansion": "*",
      "source_protocol": "*",
      "target_protocol": "*",
      "delivery_method": "*",
      "redirection": "swap-origin-redirect",
      "origin": "*",
      "subresource": [
        "worker-request",
        "module-worker",
        "shared-worker"
      ],
      "referrer_url": "*"
    },
    {
      "name": "overhead-for-redirection",
      "expansion": "*",
      "source_protocol": "*",
      "target_protocol": "*",
      "delivery_method": "*",
      "redirection": ["keep-origin-redirect", "swap-origin-redirect"],
      "origin": "*",
      "subresource": ["a-tag", "area-tag"],
      "referrer_url": "*"
    },
    {
      "name": "source-https-unsupported-by-web-platform-tests-runners",
      "expansion": "*",
      "source_protocol": "https",
      "target_protocol": "*",
      "delivery_method": "*",
      "redirection": "*",
      "origin": "*",
      "subresource": "*",
      "referrer_url": "*"
    }
  ],

  "referrer_policy_schema": [
    null,
    "no-referrer",
    "no-referrer-when-downgrade",
    "same-origin",
    "origin",
    "origin-when-cross-origin",
    "strict-origin",
    "strict-origin-when-cross-origin",
    "unsafe-url"
  ],

  "test_expansion_schema": {
    "expansion": [
      "default",
      "override"
    ],

    "delivery_method": [
      "http-rp",
      "meta-referrer",
      "attr-referrer",
      "rel-noreferrer"
    ],

    "origin": [
      "same-origin",
      "cross-origin"
    ],

    "source_protocol": [
      "http",
      "https"
    ],

    "target_protocol": [
      "http",
      "https"
    ],

    "redirection": [
      "no-redirect",
      "keep-origin-redirect",
      "swap-origin-redirect"
    ],

    "subresource": [
      "iframe-tag",
      "img-tag",
      "script-tag",
      "a-tag",
      "area-tag",
      "xhr-request",
      "worker-request",
      "module-worker",
      "shared-worker",
      "fetch-request"
    ],

    "referrer_url": [
      "omitted",
      "origin",
      "stripped-referrer"
    ]
  }
}