4 ms·

As the author, this was a pleasant surprise! :) It was written in 2013 (potentially note that in the title?) though people still frequently say they find it use

by Smerity 11y ago

As the author, this was a pleasant surprise! :) It was written in 2013 (potentially note that in the title?) though people still frequently say they find it useful. As @jstayton noted, browser support has come a long way[1], and @davecardwell notes that some of the keywords are deprecated[2]. I really should update both browser support and the "which websites use it" part. Hacker News now supports it for example, which I'm hugely glad to see! ^_^ Previous HN discussion: https://news.ycombinator.com/item?id=5778444 https://news.ycombinator.com/item?id=5778444 [1]: http://caniuse.com/#feat=referrer-policy http://caniuse.com/#feat=referrer-policy [2]: https://www.w3.org/TR/referrer-policy/#referrer-policy-states https://www.w3.org/TR/referrer-policy/#referrer-policy-state...

pbreit 11y ago
I didn't see this explicitly mentioned but if my site is HTTPS, I get referers, right? And so isn't that the easiest/best solution?
- Smerity 11y ago
  From the article: > HTTPS websites will send referrers to any other HTTPS website even if it contains sensitive information As such, having a website which is HTTPS will get you referers from both HTTP and HTTPS if they're willing to send them, but it's also important to know you can control them in case there are privacy implications such as leaking your customer's information to external HTTPS sites.
  - sopooneo 11y ago
    Thank you for this, because I think I'm about to learn from you, but I'm confused. How can you control them? Is there some way for a site to signal to a browser whether it should or send referrer headers and under what circumstances?
    - deleted 11y ago
      [deleted]
    - Smerity 11y ago
      The site can signal, either via server headers or meta tags, whether to send or withhold referrers. Adding <meta name="referrer" content="never"> will prevent referrers from being sent, whilst <meta name="referrer" content="always"> will ensure they're sent whether linking to HTTP or HTTPS. The user can of course override these if so desired - see the extensions linked to by many other commenters.
- pcthrowaway 11y ago
  I suspect if your website is HTTPS only (and HTTP auto-redirects to HTTPS), you'll probably still lose referer headers when people use http:// http:// links to your site. While Stackoverflow suggests most modern browsers will maintain the referer when following a redirect (http://stackoverflow.com/questions/2158283/will-a-302-redirect-maintain-the-referer-string http://stackoverflow.com/questions/2158283/will-a-302-redire...), I suspect this won't work if the redirect is from HTTP->HTTPS and the origin is HTTPS. However, I haven't found any conclusive information on this, and I'm too lazy to test it from various browsers right now.
bemmu 11y ago
I posted it because it was super useful while I was trying to debug some Referer header "error", which actually just turned out to be a gap in my knowledge of these various situations where the header is suppressed on purpose. Main takeaways for me: - Go from HTTPS -> HTTP and the header is lost. - <a> tag has "noreferrer" feature. Notably imgur uses this (I was trying to understand why imgur wasn't showing up in my stats properly). - There's now a meta tag which lets site owners decide if they want to give out referrer info or not.
detaro 11y ago
Why are you glad to see that HN uses the header? HN URLs contain no private information, no search terms, anything, and seeing where your traffic is coming from is interesting. I don't see the privacy or security issue here.
- Smerity 11y ago
  I agree with you. The addition of the meta tag actually allows you to see the traffic is coming from HN, even if you are a HTTP site, which was not the case when the story was written. HN also specify only to send the "origin". This could be considered a small privacy optimization though is likely of little impact.
  - detaro 11y ago
    Ah, I didn't think of non-HTTPS pages as a benefit. I think for HN sending the whole URL would be the better choice, but they probably erred on the side of caution.

by Smerity 11y ago

pbreit 11y ago

I didn't see this explicitly mentioned but if my site is HTTPS, I get referers, right? And so isn't that the easiest/best solution?

Smerity 11y ago
From the article: > HTTPS websites will send referrers to any other HTTPS website even if it contains sensitive information As such, having a website which is HTTPS will get you referers from both HTTP and HTTPS if they're willing to send them, but it's also important to know you can control them in case there are privacy implications such as leaking your customer's information to external HTTPS sites.
- sopooneo 11y ago
  Thank you for this, because I think I'm about to learn from you, but I'm confused. How can you control them? Is there some way for a site to signal to a browser whether it should or send referrer headers and under what circumstances?
  - deleted 11y ago
    [deleted]
  - Smerity 11y ago
    The site can signal, either via server headers or meta tags, whether to send or withhold referrers. Adding <meta name="referrer" content="never"> will prevent referrers from being sent, whilst <meta name="referrer" content="always"> will ensure they're sent whether linking to HTTP or HTTPS. The user can of course override these if so desired - see the extensions linked to by many other commenters.
pcthrowaway 11y ago
I suspect if your website is HTTPS only (and HTTP auto-redirects to HTTPS), you'll probably still lose referer headers when people use http:// http:// links to your site. While Stackoverflow suggests most modern browsers will maintain the referer when following a redirect (http://stackoverflow.com/questions/2158283/will-a-302-redirect-maintain-the-referer-string http://stackoverflow.com/questions/2158283/will-a-302-redire...), I suspect this won't work if the redirect is from HTTP->HTTPS and the origin is HTTPS. However, I haven't found any conclusive information on this, and I'm too lazy to test it from various browsers right now.

bemmu 11y ago

I posted it because it was super useful while I was trying to debug some Referer header "error", which actually just turned out to be a gap in my knowledge of these various situations where the header is suppressed on purpose. Main takeaways for me: - Go from HTTPS -> HTTP and the header is lost. - <a> tag has "noreferrer" feature. Notably imgur uses this (I was trying to understand why imgur wasn't showing up in my stats properly). - There's now a meta tag which lets site owners decide if they want to give out referrer info or not.

detaro 11y ago

Why are you glad to see that HN uses the header? HN URLs contain no private information, no search terms, anything, and seeing where your traffic is coming from is interesting. I don't see the privacy or security issue here.

Smerity 11y ago
I agree with you. The addition of the meta tag actually allows you to see the traffic is coming from HN, even if you are a HTTP site, which was not the case when the story was written. HN also specify only to send the "origin". This could be considered a small privacy optimization though is likely of little impact.
- detaro 11y ago
  Ah, I didn't think of non-HTTPS pages as a benefit. I think for HN sending the whole URL would be the better choice, but they probably erred on the side of caution.