diff --git a/core/modules/node/src/Controller/NodePreviewController.php b/core/modules/node/src/Controller/NodePreviewController.php
index 96b65b5..976278f 100644
--- a/core/modules/node/src/Controller/NodePreviewController.php
+++ b/core/modules/node/src/Controller/NodePreviewController.php
@@ -29,6 +29,11 @@ public function view(EntityInterface $node_preview, $view_mode_id = 'full', $lan
     unset($build['#cache']);
 
     foreach ($node_preview->uriRelationships() as $rel) {
+      // Only add links the user is allowed to visit.
+      if (!$node_preview->urlInfo($rel)->access()) {
+        continue;
+      }
+
       // Set the node path as the canonical URL to prevent duplicate content.
       $build['#attached']['html_head_link'][] = array(
         array(
diff --git a/core/modules/node/src/Controller/NodeViewController.php b/core/modules/node/src/Controller/NodeViewController.php
index 8a756b3..f3fee29 100644
--- a/core/modules/node/src/Controller/NodeViewController.php
+++ b/core/modules/node/src/Controller/NodeViewController.php
@@ -22,7 +22,13 @@ class NodeViewController extends EntityViewController {
   public function view(EntityInterface $node, $view_mode = 'full', $langcode = NULL) {
     $build = parent::view($node);
 
+    // Add uri relationships as link tags.
     foreach ($node->uriRelationships() as $rel) {
+      // Only add links the user is allowed to visit.
+      if (!$node->urlInfo($rel)->access()) {
+        continue;
+      }
+
       // Set the node path as the canonical URL to prevent duplicate content.
       $build['#attached']['html_head_link'][] = array(
         array(
diff --git a/core/modules/node/src/Tests/NodeViewTest.php b/core/modules/node/src/Tests/NodeViewTest.php
index c60d44a..e544a29 100644
--- a/core/modules/node/src/Tests/NodeViewTest.php
+++ b/core/modules/node/src/Tests/NodeViewTest.php
@@ -20,7 +20,10 @@ class NodeViewTest extends NodeTestBase {
    */
   public function testHtmlHeadLinks() {
     $node = $this->drupalCreateNode();
+    $node->setNewRevision();
+    $node->save();
 
+    $this->drupalLogin($this->drupalCreateUser(['bypass node access', 'view all revisions']));
     $this->drupalGet($node->urlInfo());
 
     $result = $this->xpath('//link[@rel = "version-history"]');
@@ -31,6 +34,18 @@ public function testHtmlHeadLinks() {
 
     $result = $this->xpath('//link[@rel = "canonical"]');
     $this->assertEqual($result[0]['href'], $node->url());
+
+    $this->drupalLogout();
+    $this->drupalGet($node->urlInfo());
+
+    $result = $this->xpath('//link[@rel = "version-history"]');
+    $this->assertEqual(count($result), 0);
+
+    $result = $this->xpath('//link[@rel = "edit-form"]');
+    $this->assertEqual(count($result), 0);
+
+    $result = $this->xpath('//link[@rel = "canonical"]');
+    $this->assertEqual($result[0]['href'], $node->url());
   }
 
   /**
diff --git a/core/modules/taxonomy/taxonomy.module b/core/modules/taxonomy/taxonomy.module
index f7c8c0e..3a12110 100644
--- a/core/modules/taxonomy/taxonomy.module
+++ b/core/modules/taxonomy/taxonomy.module
@@ -93,6 +93,11 @@ function taxonomy_page_attachments_alter(array &$page) {
   $route_match = \Drupal::routeMatch();
   if ($route_match->getRouteName() == 'entity.taxonomy_term.canonical' && ($term = $route_match->getParameter('taxonomy_term')) && $term instanceof TermInterface) {
     foreach ($term->uriRelationships() as $rel) {
+      // Only add links the user is allowed to visit.
+      if (!$term->urlInfo($rel)->access()) {
+        continue;
+      }
+      
       // Set the URI relationships, like canonical.
       $page['#attached']['html_head_link'][] = array(
         array(