No `Referer:`, no embedding

Product Support
5

Given that this is going to be the default browser standard from Chrome 85 onwards (A new default Referrer-Policy for Chrome - strict-origin-when-cross-origin  |  Blog  |  Chrome for Developers), should we look at an alternative here?

Can we accept requests which match all of the following three conditions

  • Request contains both discourseEmbedUrl and Referer
  • The referer is set to the origin of the discourseEmbedUrl
  • The discourseEmbedUrl matches one of the of the embedding rules

I think passing the discourseEmbedUrl would be easy to do for a majority of users.