For a dynamic web app like Discourse, referer policy is probably more useful to be set at a page scope rather than for individual links.
To dynamically set referer policy, use the <meta> element, and the last set policy prevails, which makes it very easy to code.
An example policy:
- "
no-referrer-when-downgrade" by default - "
strict-origin-when-cross-origin" when viewing private messages or secure categories
With a site setting to change it to always be “strict-origin-when-cross-origin”, turned on by default for login required sites.
If we decide Discourse doesn’t need its own referer information, strict-when-cro can be upgraded to “strict-origin” to save bandwidth.