The strict-origin-when-cross-origin value for SVG specifies the ASCII serialization of the origin of the referrerURL for requests: whose referrerURL and current URL are both potentially trustworthy URLs, or whose referrerURL is a non-potentially trustworthy URL.

Requests whose referrerURL is a potentially trustworthy URL and whose current URL is a non-potentially trustworthy URL on the other hand, will contain no referrer information. A Referer HTTP header will not be sent.

strict-origin-when-cross-origin

• empty-string
• no-referrer
• no-referrer-when-downgrade
• origin
• origin-when-cross-origin
• same-origin
• strict-origin
• unsafe-url

• World Wide Web Consortium (W3C)