Imagine an html file on my windows desktop. Within this html there is an image tag that loads an image from the internet, like an emoji from some website.
If that html was on some(my) server, the emoji server could see that www.myurl.com/site.html requested that image. Right ?!
But the html on my desktop would reveal my windows username as the filepath is the usual c:/users/name/desktop. Or not ?
Short answer: your browser shouldn't. From Referer - HTTP | MDN (emphasis mine):
A
Refererheader is not sent by browsers if:
- The referring resource is a local "file" or "data" URI.
- An unsecured HTTP request is used and the referring page was received with a secure protocol (HTTPS).
However, it is not specifically forbidden by RFC 7231):
Most general-purpose user agents do not send the
Refererheader field when the referring resource is a local "file" or "data" URI.
The true answer is that it will depend on how your browser has implemented the behavior.