4 ms·
Lots of people block referral headers. Browsers also drop them across HTTPS->HTTP boundaries.
by tokenizerrr 11y ago
Lots of people block referral headers. Browsers also drop them across HTTPS->HTTP boundaries.
- nacs 11y ago> Lots of people block referral headers Source? I would think most people run stock browsers that don't manipulate referrer headers.
- tokenizerrr 11y agoJust take a look at the amount of times https://chrome.google.com/webstore/detail/referer-control/hnkcfpcejkafcihlgbojoidoihckciin?hl=en https://chrome.google.com/webstore/detail/referer-control/hn... has been installed. And that's just one extension for one browser.
- nacs 11y ago100K users out of 3B+ internet users [1]? I don't think that qualifies as 'lots of people'. [1]: http://www.internetlivestats.com/internet-users/ http://www.internetlivestats.com/internet-users/
- tokenizerrr 11y ago100K users of a single extension for a single browser. I'll leave it to you to get the numbers for all other extensions for all other browsers. And don't forget that uBlock can do this as well.
- deleted 11y ago[deleted]
- tempestn 11y agoThey're not as popular as they used to be, but many popular security packages (ie Norton Internet Security I believe) also blank all outgoing referrers.
- profmonocle 11y agoThe expiration date+HMAC is still an option. Plus, the number of users blocking referrer headers is probably small enough that a site owner doing this wouldn't care. And browsers dropping the header from HTTPS -> HTTP isn't an issue if you only want to allow access from your own domain. (If you want to authorize third-party sites that use HTTPS, you'd just have to use HTTPS yourself.)