A Referer header is not sent by browsers if the referring resource is a local "file" or "data" URI.
Is this true for all major, modern browsers (Safari, Chrome, Firefox, Explorer)?
Put differently, if you save a web page to your local hard drive, and double click the
.html file, can you be 100% certain your local hard drive path is not sent anywhere when the browser requests images, scripts, etc. with absolute http:// paths to servers on the Internet?
(Since the answer seems to be yes, out of curiosity: How does it happen in practice, that browsers implement a security measure like this over the whole line? Does one browser just do it first, and then the others follow because they don't want to be seen with poorer security? Is one particular browser often first with stuff like this? Is it decided by W3C or some committee?)