3 ms·

I didn't see this explicitly mentioned but if my site is HTTPS, I get referers, right? And so isn't that the easiest/best solution?

by pbreit 11y ago

Smerity 11y ago
From the article: > HTTPS websites will send referrers to any other HTTPS website even if it contains sensitive information As such, having a website which is HTTPS will get you referers from both HTTP and HTTPS if they're willing to send them, but it's also important to know you can control them in case there are privacy implications such as leaking your customer's information to external HTTPS sites.
- sopooneo 11y ago
  Thank you for this, because I think I'm about to learn from you, but I'm confused. How can you control them? Is there some way for a site to signal to a browser whether it should or send referrer headers and under what circumstances?
  - deleted 11y ago
    [deleted]
  - Smerity 11y ago
    The site can signal, either via server headers or meta tags, whether to send or withhold referrers. Adding <meta name="referrer" content="never"> will prevent referrers from being sent, whilst <meta name="referrer" content="always"> will ensure they're sent whether linking to HTTP or HTTPS. The user can of course override these if so desired - see the extensions linked to by many other commenters.
pcthrowaway 11y ago
I suspect if your website is HTTPS only (and HTTP auto-redirects to HTTPS), you'll probably still lose referer headers when people use http:// http:// links to your site. While Stackoverflow suggests most modern browsers will maintain the referer when following a redirect (http://stackoverflow.com/questions/2158283/will-a-302-redirect-maintain-the-referer-string http://stackoverflow.com/questions/2158283/will-a-302-redire...), I suspect this won't work if the redirect is from HTTP->HTTPS and the origin is HTTPS. However, I haven't found any conclusive information on this, and I'm too lazy to test it from various browsers right now.

I didn't see this explicitly mentioned but if my site is HTTPS, I get referers, right? And so isn't that the easiest/best solution?

by pbreit 11y ago

I didn't see this explicitly mentioned but if my site is HTTPS, I get referers, right? And so isn't that the easiest/best solution?

Smerity 11y ago

From the article: > HTTPS websites will send referrers to any other HTTPS website even if it contains sensitive information As such, having a website which is HTTPS will get you referers from both HTTP and HTTPS if they're willing to send them, but it's also important to know you can control them in case there are privacy implications such as leaking your customer's information to external HTTPS sites.

sopooneo 11y ago
Thank you for this, because I think I'm about to learn from you, but I'm confused. How can you control them? Is there some way for a site to signal to a browser whether it should or send referrer headers and under what circumstances?
- deleted 11y ago
  [deleted]
- Smerity 11y ago
  The site can signal, either via server headers or meta tags, whether to send or withhold referrers. Adding <meta name="referrer" content="never"> will prevent referrers from being sent, whilst <meta name="referrer" content="always"> will ensure they're sent whether linking to HTTP or HTTPS. The user can of course override these if so desired - see the extensions linked to by many other commenters.

pcthrowaway 11y ago

I suspect if your website is HTTPS only (and HTTP auto-redirects to HTTPS), you'll probably still lose referer headers when people use http:// http:// links to your site. While Stackoverflow suggests most modern browsers will maintain the referer when following a redirect (http://stackoverflow.com/questions/2158283/will-a-302-redirect-maintain-the-referer-string http://stackoverflow.com/questions/2158283/will-a-302-redire...), I suspect this won't work if the redirect is from HTTP->HTTPS and the origin is HTTPS. However, I haven't found any conclusive information on this, and I'm too lazy to test it from various browsers right now.