4 ms·
It seems that this can be used to easily disallow hotlinking of content. It should be enough for a content hosting site to set any cookie (doesn't need to be a
by mixedbit 10y ago
It seems that this can be used to easily disallow hotlinking of content. It should be enough for a content hosting site to set any cookie (doesn't need to be a secret cookie) with the
Same-site parameter and drop all requests without the cookie.
- stingraycharles 10y agoIsn't that already possible without this ?
- haikuginger 10y agoNot really. Hotlink protections at present check the Referer header to see if the request was initiated by another site. Not only can this be bypassed on a browser level, HTML5 allows <a> tags to have the rel="noreferrer" attribute, which prevents the referrer from being set. This proposal allows sites to set a cookie (essentially, an authorization token), that must be actively sent for data to be available, and which can only be sent when the site being browsed matches the domain on the cookie.