I'm trying to understand the behavior of HTTP referer header. I noticed that sometimes the referer is full (full URL, including path and query string) but mostly it includes the domain only.
For example 'https://www.google.com/' instead of 'https://www.google.com/search?q=http+referer+truncated&oq=http+referer+truncated&aqs=chrome..69i57.6485j0j1&sourceid=chrome&ie=UTF-8#q=http+referer+is+not+full'
Are there any rules as to when the refere and is full and when it's truncated?
Updated details as of Nov 2020...
Many browsers have started to default to a stricter referrer policy (strict-origin-when-cross-origin) when making a cross-domain request instead of the old default (no-referrer-when-downgrade). This will most often result in truncated urls, but occasionally means that the referrer will not be set at all (no-referrer).
Here is an excerpt from a good article about this: https://plausible.io/blog/referrer-policy
Chrome is using
strict-origin-when-cross-originfrom version 85. Strict-origin-when-cross-origin is where the full path is sent if on the same domain but only sends the domain itself if going to another domain. Previously it usedno-referrer-when-downgrade.
Firefox is using
no-referrer-when-downgradeby default. It always passes the full path unless the request is sent from HTTPS to HTTP. Firefox is usingstrict-origin-when-cross-originin the Private Browsing tabs and for known trackers.
Edge is using
no-referrer-when-downgrade. Same as Firefox.
Safari is using
strict-origin-when-cross-origin. Same as Chrome.
Brave is using
no-referrerwhere the referrer header is completely removed. It never shares the full URL even for same-origin requests and you cannot even see the domain name for cross-origin requests.
There is both the Referrer-Policy header AND the referrer meta tag.
<meta name="referrer" content="none">
They seem to do exactly the same job (as described in @Ulug's answer). If both are present I don't know how the browser decides which to choose, I just deleted the HTML one to solve my problem.