Description:

in this file:

https://github.com/RocketChat/Rocket.Chat/blob/develop/packages/rocketchat-ui-master/server/inject.js

it says:

Inject.rawHead('noreferrer', '');

That's a typo. See https://lists.w3.org/Archives/Public/public-webappsec/2015May/0064.html

it should be origin-when-cross-origin