4 ms·

The URL refresh thing can be done without JavaScript by having a little server side entrypoint that redirects to a destination URL with the same header. I beli

The URL refresh thing can be done without JavaScript by having a little server side entrypoint that redirects to a destination URL with the same header. I believe it should be widely supported.

kevincox 10y ago
If I understand you correctly you would still have a Referer header that said you came from fastmail.com, however it could be stripped of other sensitive information. So the URL would be something like "https://fastmail.com/redirect?u=https://example.com" https://fastmail.com/redirect?u=https://example.com"
- wodenokoto 10y ago
  that was the first solution i thought of when i saw the article and i believe it to be quite common.
- duskwuff 10y ago
  If you do that, though, you have to make sure you don't introduce an open redirect: https://www.owasp.org/index.php/Open_redirect https://www.owasp.org/index.php/Open_redirect It's not a huge issue, given the number of open redirects on the Internet, but it may put your site at risk of being used in phishing attacks.
  - jtl999 10y ago
    Facebook uses a method called LinkShim with a bit of JavaScript (to avoid garabling copy&pasted links) and a hash of the URL generated serverside to avoid open redirects. I'm thinking on working on my own implementation for a project https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/ https://www.facebook.com/notes/facebook-security/link-shim-p...
  - cmdrfred 10y ago
    I'm building a end to end encrypted chat platform in JS (I'm aware of the risks here it's a toy project) and I might have to use an open redirect to prevent urls from leaking out of messages before they are clicked. I was thinking of doing something like external-link.domain.io/redirect?url=https://www.google.com https://www.google.com to make it obvious.
    - kevincox 10y ago
      Yeah. The concept of an "untrusted" domain is commonly used for things like this. IIRC Google uses googleusercontent.com
    - homero 10y ago
      Sign them too
- itsnotlupus 10y ago
  sorry I was on mobile when I first commented. I meant to say that if your /redirect entrypoint returns a Header that looks like Refresh: 0; URL={url} Your visitors' browsers will remove the referer header altogether when loading {url}. This is in contrast to the more common Location: {url} header.
geofft 10y ago
Does that entry point need to be protected in any way from people using it ... maliciously ... somehow? I recall people being upset about open redirects in the past, but I can't actually formulate a coherent security objection to it. It looks like Slack's https://slack-redir.net/link?url=http://www.example.com/ https://slack-redir.net/link?url=http://www.example.com/ isn't locked down, for instance.
- slig 10y ago
  It should be locked otherwise you can trick people into clicking on a link thinking it belongs to that company. Google, for instance, does protect against that, so you can't use http://www.google.com/url?http://www.example.com/ http://www.google.com/url?http://www.example.com/

The URL refresh thing can be done without JavaScript by having a little server side entrypoint that redirects to a destination URL with the same header. I believe it should be widely supported.

kevincox 10y ago

If I understand you correctly you would still have a Referer header that said you came from fastmail.com, however it could be stripped of other sensitive information. So the URL would be something like "https://fastmail.com/redirect?u=https://example.com" https://fastmail.com/redirect?u=https://example.com"

wodenokoto 10y ago
that was the first solution i thought of when i saw the article and i believe it to be quite common.
duskwuff 10y ago
If you do that, though, you have to make sure you don't introduce an open redirect: https://www.owasp.org/index.php/Open_redirect https://www.owasp.org/index.php/Open_redirect It's not a huge issue, given the number of open redirects on the Internet, but it may put your site at risk of being used in phishing attacks.
- jtl999 10y ago
  Facebook uses a method called LinkShim with a bit of JavaScript (to avoid garabling copy&pasted links) and a hash of the URL generated serverside to avoid open redirects. I'm thinking on working on my own implementation for a project https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/ https://www.facebook.com/notes/facebook-security/link-shim-p...
- cmdrfred 10y ago
  I'm building a end to end encrypted chat platform in JS (I'm aware of the risks here it's a toy project) and I might have to use an open redirect to prevent urls from leaking out of messages before they are clicked. I was thinking of doing something like external-link.domain.io/redirect?url=https://www.google.com https://www.google.com to make it obvious.
  - kevincox 10y ago
    Yeah. The concept of an "untrusted" domain is commonly used for things like this. IIRC Google uses googleusercontent.com
  - homero 10y ago
    Sign them too
itsnotlupus 10y ago
sorry I was on mobile when I first commented. I meant to say that if your /redirect entrypoint returns a Header that looks like Refresh: 0; URL={url} Your visitors' browsers will remove the referer header altogether when loading {url}. This is in contrast to the more common Location: {url} header.

geofft 10y ago

Does that entry point need to be protected in any way from people using it ... maliciously ... somehow? I recall people being upset about open redirects in the past, but I can't actually formulate a coherent security objection to it. It looks like Slack's https://slack-redir.net/link?url=http://www.example.com/ https://slack-redir.net/link?url=http://www.example.com/ isn't locked down, for instance.

slig 10y ago
It should be locked otherwise you can trick people into clicking on a link thinking it belongs to that company. Google, for instance, does protect against that, so you can't use http://www.google.com/url?http://www.example.com/ http://www.google.com/url?http://www.example.com/