From 0376d402b033d14a34661b968b29d165bacc8fbc Mon Sep 17 00:00:00 2001
From: polybjorn <service@polybjorn.com>
Date: Wed, 29 Apr 2026 13:20:12 +0000
Subject: [PATCH] fix: use spec-compliant `no-referrer` meta value (#8725)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`never` was removed from the Referrer Policy spec in 2016 and is
only honoured by current browsers as a legacy alias. Replace with
the spec-compliant `no-referrer` token.

Tested:
- Safari 26 (WebKit): Referer suppressed
- LibreWolf 150 (Gecko): Referer suppressed
- Chromium 149 (Blink): Referer suppressed
- SeaMonkey 2.53.23: ignores meta referrer regardless of value
  (pre-existing, unaffected by this change)

Closes https://github.com/FreshRSS/FreshRSS/issues/8718

Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
---
 app/layout/layout.phtml | 2 +-
 app/layout/simple.phtml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/layout/layout.phtml b/app/layout/layout.phtml
index 1491483e1..aea36e75a 100644
--- a/app/layout/layout.phtml
+++ b/app/layout/layout.phtml
@@ -45,7 +45,7 @@
 		<meta name="msapplication-TileColor" content="#FFF" />
 		<meta name="theme-color" content="#FFF" />
 <?php if (!FreshRSS_Context::systemConf()->allow_referrer) { ?>
-		<meta name="referrer" content="never" />
+		<meta name="referrer" content="no-referrer" />
 <?php } ?>
 		<?= FreshRSS_View::headTitle() ?>
 <?php
diff --git a/app/layout/simple.phtml b/app/layout/simple.phtml
index 2a14682c9..85391e77a 100644
--- a/app/layout/simple.phtml
+++ b/app/layout/simple.phtml
@@ -33,7 +33,7 @@
 		<meta name="msapplication-TileColor" content="#FFF" />
 		<meta name="theme-color" content="#FFF" />
 <?php if (!FreshRSS_Context::systemConf()->allow_referrer) { ?>
-		<meta name="referrer" content="never" />
+		<meta name="referrer" content="no-referrer" />
 <?php } ?>
 		<?= FreshRSS_View::headTitle() ?>
 		<?php if ($this->rss_url != ''): ?>