6 ms·
Are there any reasons not to get rid of referers altogether?
by joelthelion 9y ago
Are there any reasons not to get rid of referers altogether?
- kuon 9y agoI was wondering the same thing.
- TheCoreh 9y agoThey are useful to prevent the hotlinking of images/video from third party domains, which can incur in significant bandwidth costs for smaller websites.
- deleted 9y ago[deleted]
- peterwwillis 9y agoAlso paywall skipping, to track what sites are bringing you traffic, to pass fields to forms to report problems, to present targeted traffic based on use, and of course, advertising.
- ori_b 9y agoThe question was for reasons to __not__ remove them.
- deleted 9y ago[deleted]
- mi100hael 9y agoAnd those are all answers...?
- executesorder66 9y agoThey want to know reasons why a user would want to keep the referrer, not the asshole that is tracking them.
- kuschku 9y agoHow are those answers supposed to convince me to keep the referer setting in my browser on? In fact, they're even more likely to convince me to turn it off.
- koolba 9y agoThat would continue to work fine with a default same origin allowance. A separate domain would require a referral policy.
- pawelk 9y agoOrigin policy is a client thing. Referrer is accessible to the server. It's like using robots.txt vs. HTTP Auth to protect your content.
- nothrabannosir 9y agoReferrer is also a client thing. Referrer based hotlink protection implicitly trusts the visitors' UAs. Same for Origin; it just offloads the actual check to the visitor. No big difference. HTTP Auth, on the other hand, is actual password protection which cannot be spoofed by a malicious client. Very different from robots.txt.
- alkonaut 9y agoThis is just like traffic statistics - a help to the host, not the client. This is data sent voluntarily by the client so there has to be some direct benefit to the client in sending it, or at least sending any more than the domain name with out path, subdomain and parameters?
- throwaway2016a 9y agoReferral headers can be very useful for tracking down fraud and phishing activities. Although tracking down fraud is usually as it relates fraudulent traffic which mostly effects advertising so I imagine a lot of the commenters here would say that is not a good reason.
- beardog 9y agoSites can outright disable referrers using a meta tag: https://www.w3.org/TR/referrer-policy/#referrer-policy-no-referrer https://www.w3.org/TR/referrer-policy/#referrer-policy-no-re...
- throwaway_boi 9y agoPreventing CSRF attacks: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Checking_the_Referer_Header https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(...
- tmd83 9y agoThis. For this you just need the origin though. There's an origin header for 10 years which makes CSRF protection so trivial yet its still not available in all browsers. Firefox can leak referer in regular mode but can't send origin? Not sure. Anyone knows a good document on when/which browser actually sends referer header?
- throwaway_boi 9y agoFirefox and Edge don't send Origin headers with POST requests[0] while all send Referer.[1] 0: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or... 1: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
- marcell 9y agoIf you have a giant traffic spike, it's nice to know where it came from. Eg. if you get linked on Hacker News, you can go to the thread and engage with potential customers.
- orthecreedence 9y agoWeird, every time I get HN traffic the referrer is the HN homepage, never individual posts. Is it just me?
- yorwba 9y agoI guess that's because people click on the link while it's on the frontpage, not from the post's comments section.
- joelthelion 9y agoOf course, but that's from the point of view of site owners. Browsers are owned by their users.
- alkonaut 9y agoThat's not really a direct reason for the client to send them though. There are tons of useful things about referrers to the host. Stripping everything but the domain should be mostly ok for the client though, so if I come from a.b.com/foo, it just sends b.com as referrer? Both "a" and "foo" can hold any amount of data so those would have to go. Sending b.com should be enough to provide traffic statistics?