3 ms·
Because complaining about "mixed content" was completely pointless in the general case -- you could mix content across multiple https sites, but the certificat
by blasdel 16y ago
Because complaining about "mixed content" was completely pointless in the general case -- you could mix content across multiple https sites, but the certificates were never correlated, and the second site would still get all the headers just the same.
It's extraordinarily user-hostile, and would just add to the pile of pointless wankery that keeps people from using https (see also: shitting all over self-signed certs when in reality the CAs don't do shit for their rent and identity is useless anyway).
The actual solution is to never send Referer headers for cross-site requests from an HTTPS page.
- jacquesm 16y ago> The actual solution is to never send Referer headers for cross-site requests from an HTTPS page. That should be on someone's todo list at the major browser vendors. You're right, there really is no point in sending that header along, and sending it can cause all kinds of trouble.