'How to use different Referrer-Policy for different origins

Is it possible to use a different Referrer-Policy for different origins?

I'm currently building an application that uses NextJS for the frontend and Express for the backend. I'm building a new feature for this application which allows a document owner to generate an editToken. Then, any user who visits a page with ?editToken=<valid token> will have permissions to edit that document.

To perform authorization on the backend, I want to have that editToken query param to be sent with the request - then the backend can check if the provided edit token matches the value in the database for the specific document being viewed. I've found that since I'm running my frontend on port 3000 and my backend on port 5001 locally, a Referrer-Policy of strict-origin-when-cross-origin strips out the query params - this means the backend doesn't know if the user is visiting a URL with the correct editToken. Similarly, when I run my app in production, the frontend runs at https://mywebsite.com and the backend at https://api.mywebsite.com which runs into the same cross origin problem.

I've found I can set a Referrer-Policy of no-referrer-when-downgrade but I'd rather not leak info to origins I don't control.

Is there a way to dynamically change the Referrer-Policy based on which origin the request is going to? I'd like to be able to whitelist certain origins that I know I own so that I can send more referrer information to them.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source