SPFx assets fail to load in Safari on iOS when parent site uses Referrer-Policy: no-referrer #10656
Description
Target SharePoint environment
SharePoint Online
What SharePoint development model, framework, SDK or API is this about?
💥 SharePoint Framework
Developer environment
Windows
What browser(s) / client(s) have you tested
- 💥 Internet Explorer
- 💥 Microsoft Edge
- 💥 Google Chrome
- 💥 FireFox
- 💥 Safari
- mobile (iOS/iPadOS)
- mobile (Android)
- not applicable
- other (enter in the "Additional environment details" area below)
Additional environment details
Environment
- Device: iPhone (multiple tested)
- OS: iOS 26
- Browser: Safari (mobile)
- SPFx version: Observed across multiple versions (likely version-independent)
- Hosting model: Standard SharePoint Online with default public CDN
Describe the bug / error
Summary
When accessing a SharePoint Online site (System B) containing an SPFx web part from a different system (System A) that sets Referrer-Policy: no-referrer, Safari on iOS (observed on iOS 26) appears to inherit the no-referrer policy into the newly opened tab.
As a result, requests to the default SPFx asset CDN:
https://public-cdn.sharepointonline.com/<tenant>.sharepoint.com
are sent without a Referer header, causing the CDN to redirect to:
https://localhost/AccessOutsideSharePointIsNotAllowed
This results in the SPFx web part failing to load.
This behavior appears specific to Safari on iOS and does not reproduce in other tested browsers (some users has reported it on Safari on Mac, but not consistently reproduceable. Other browsers unaffected.)
Scenario Description
System A
- Returns HTTP header:
Referrer-Policy: no-referrer - Contains a link to a SharePoint Online site (System B)
- The link opens in a new tab/window
System B
- SharePoint Online site
- Contains an SPFx web part
- SPFx assets are loaded from:
https://public-cdn.sharepointonline.com/<tenant>.sharepoint.com
Request Flow (Simplified)
sequenceDiagram
participant User
participant Safari_iOS
participant System_A
participant System_B as System B (SPO Site)
participant SPO_Public_CDN as SPO Public CDN
User->>System_A: Access site (Referrer-Policy: no-referrer)
User->>Safari_iOS: Click link (opens new tab)
Safari_iOS->>System_B: Navigate to SharePoint page
System_B->>SPO_Public_CDN: Load SPFx JS bundle
Note right of SPO_Public_CDN: Request has NO Referer header
SPO_Public_CDN-->>Safari_iOS: Redirect to /AccessOutsideSharePointIsNotAllowed
Safari_iOS-->>User: SPFx webpart fails to load
Technical Analysis
The default SharePoint Online public CDN appears to enforce referer validation and expects requests to originate from a SharePoint Online context.
When the Referer header is missing:
- The CDN assumes access is happening outside SharePoint
- The request is redirected to:
https://localhost/AccessOutsideSharePointIsNotAllowed
Safari on iOS appears to propagate or inherit the no-referrer policy from the originating page (System A) to the newly opened tab. This results in:
- All subsequent resource requests (including CDN scripts) being sent without a
Refererheader - Triggering CDN access protection
This inheritance behavior does not appear to occur in:
- Chrome (desktop/mobile)
- Edge
- (Desktop Safari?)
It looks like the issue has 2 parts.
- public-cdn.sharepointonline.com is using Referer as some kind of security function and it looks that is not very stable. However it only checks if the header exist, the value can be anything you'd like.
- iOS has a bug (or feature?) that uses Referrer Policy from one site on everything, even if you navigate somewhere else in another tab and keep that cached until you clear bowser cache. This is not something can be fixed by MS, but it might need to be taken into consideration since it might affect a lot of users.
Steps to reproduce
- Configure System A to return:
Referrer-Policy: no-referrer
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>Page</title>
</head>
<body>
<a target="_blank" class="text-decoration-none body" href="https://tenant.sharepoint.com/sites/site/sitepates/page.aspx" > testlink</a>
</body>
</html>const express = require('express');
const path = require('path');
const app = express();
app.use((req, res, next) => {
res.setHeader('Referrer-Policy', 'no-referrer');
next();
});
app.use(express.static(path.join(__dirname, 'dist')));
app.get('*', (_, res) =>
res.sendFile(path.join(__dirname, 'dist/index.html'))
);ß
app.listen(4200, () => {
console.log('Server is running on http://localhost:4200');
});- Add a link in System A to a SharePoint Online site (System B).
- Ensure the link opens in a new tab/window.
- Add an SPFx web part to the landing page in System B.
- Open System A in Safari on iOS.
- Click the link to System B.
- Observe:
- SPFx assets fail to load
- Network request to
public-cdn.sharepointonline.comcontains noRefererheader - Redirect to
/AccessOutsideSharePointIsNotAllowed
Expected Behavior
Opening System B in a new tab should result in:
- Normal loading of SPFx assets
Refererheader correctly set for CDN requests or resource not blocked when missing- No redirect to
AccessOutsideSharePointIsNotAllowed - SPFx web part renders correctly
Actual Behavior (Safari iOS Only)
-
The
no-referrerpolicy appears to be inherited into the new tab. -
Requests to
public-cdn.sharepointonline.comare made without aRefererheader. -
The CDN redirects to:
https://localhost/AccessOutsideSharePointIsNotAllowed -
SPFx web part fails to load.