Fixed #31232 -- Changed default SECURE_REFERRER_POLICY to 'same-origin'.

2 files changed, 22 insertions, 1 deletions

diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt
index b4a5bdc48f..8c3f6f2b47 100644
--- a/docs/ref/settings.txt
+++ b/docs/ref/settings.txt
@@ -2395,12 +2395,16 @@ from URL paths, so patterns shouldn't include them, e.g.
 
 .. versionadded:: 3.0
 
-Default: ``None``
+Default: ``'same-origin'``
 
 If configured, the :class:`~django.middleware.security.SecurityMiddleware` sets
 the :ref:`referrer-policy` header on all responses that do not already have it
 to the value provided.
 
+.. versionchanged:: 3.1
+
+    In older versions, the default value is ``None``.
+
 .. setting:: SECURE_SSL_HOST
 
 ``SECURE_SSL_HOST``
diff --git a/docs/releases/3.1.txt b/docs/releases/3.1.txt
index 4a165156e1..903e2510ba 100644
--- a/docs/releases/3.1.txt
+++ b/docs/releases/3.1.txt
@@ -285,6 +285,19 @@ Requests and Responses
 * The new :meth:`.HttpRequest.accepts` method returns whether the request
   accepts the given MIME type according to the ``Accept`` HTTP header.
 
+.. _whats-new-security-3.1:
+
+Security
+~~~~~~~~
+
+* The :setting:`SECURE_REFERRER_POLICY` setting now defaults to
+  ``'same-origin'``. With this configured,
+  :class:`~django.middleware.security.SecurityMiddleware` sets the
+  :ref:`referrer-policy` header to ``same-origin`` on all responses that do not
+  already have it. This prevents the ``Referer`` header being sent to other
+  origins. If you need the previous behavior, explicitly set
+  :setting:`SECURE_REFERRER_POLICY` to ``None``.
+
 Serialization
 ~~~~~~~~~~~~~
 
@@ -452,6 +465,10 @@ Miscellaneous
 * Providing a non-local remote field in the :attr:`.ForeignKey.to_field`
   argument now raises :class:`~django.core.exceptions.FieldError`.
 
+* :setting:`SECURE_REFERRER_POLICY` now defaults to ``'same-origin'``. See the
+  *What's New* :ref:`Security section <whats-new-security-3.1>` above for more
+  details.
+
 .. _deprecated-features-3.1:
 
 Features deprecated in 3.1