Thx, we should add it. I think we already set this for most links (not globally) and sometimes use our proxy to remove the referrer but would be better to also set it globally

Note: the rel=noreferrer is already set on the Provider/Org links (so referrer does not leak to these websites).

rel=noreferrer is a good step.
Since it's not support by every browser one may should add some extra levels of forcing it

See:

source: https://en.wikipedia.org/wiki/Comparison_of_layout_engines_%28HTML5%29

When we link to external websites where the URL linked to was "user submitted" (for example via the Tracking API referrer website tracking), it's very useful to set rel=noreferrer because it protects us against phishing attacks using the window.opener technique described in https://mathiasbynens.github.io/rel-noopener/#hax - so I'm adding now the component "Security" label to this issue.

just a thought: issues with security label should be handled with some prio... (18month till report now...)

@Findus23 is this maybe done already re the header etc?

@tsteur After #17842 this is un-done again as we would need to find a way to add noreferrer to every single link if we don't want to use the header

That's only for the overlay though? By default it would use Common::sendHeader('Referrer-Policy: same-origin');

Ah, that's what I missed: I didn't know that this->useStrictReferrerPolicy is true everywhere except for the overlay.
In that case I think the issue is solved.