diff --git a/libraries/classes/Header.php b/libraries/classes/Header.php
index 592c3b9b0d..7916094469 100644
--- a/libraries/classes/Header.php
+++ b/libraries/classes/Header.php
@@ -494,7 +494,7 @@ class Header
$headers['X-Frame-Options'] = 'DENY';
}
- $headers['Referrer-Policy'] = 'no-referrer';
+ $headers['Referrer-Policy'] = 'same-origin';
$headers = array_merge($headers, $this->getCspHeaders());
diff --git a/templates/header.twig b/templates/header.twig
index 2e7e991c3e..0ff2f164fb 100644
--- a/templates/header.twig
+++ b/templates/header.twig
@@ -3,7 +3,7 @@
-
+
{% if not allow_third_party_framing -%}
diff --git a/test/classes/HeaderTest.php b/test/classes/HeaderTest.php
index c9aa4f16a7..5046b06e0c 100644
--- a/test/classes/HeaderTest.php
+++ b/test/classes/HeaderTest.php
@@ -162,7 +162,7 @@ class HeaderTest extends AbstractTestCase
$expected = [
'X-Frame-Options' => $expectedFrameOptions,
- 'Referrer-Policy' => 'no-referrer',
+ 'Referrer-Policy' => 'same-origin',
'Content-Security-Policy' => $expectedCsp,
'X-Content-Security-Policy' => $expectedXCsp,
'X-WebKit-CSP' => $expectedWebKitCsp,