7 ms·

Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.

deleted 9y ago
[deleted]
jacquesm 9y ago
Frankly: that's their problem. If your business model revolves around client side security then you have other problems.
- deleted 9y ago
  [deleted]
- Fnoord 9y ago
  I get what you're saying and I agree but it is a bit more nuanced. Say you want to read a certain news article, and if you get referred to it by Google you can read it, otherwise not. Now, lets say you've been finding news articles to read that way via Google the past years. Suddenly, with Firefox 59, this no longer works. Without even informing the user. That is not user-friendly.
  - jacquesm 9y ago
    Sites should be penalized for giving preference to one kind of link over another. Why should Google have even more of an upper hand than they already have? To me this is a super good illustration of why we probably should get rid of the 'Referer' (sic) header altogether.
    - Fnoord 9y ago
      Agreed, but the short-term loser of this change is the non-technical customer who's workflow is suddenly broken, and only in Firefox, and only in version 59. Apparently only in Private Mode though which makes my use case probably less common. Thing is, do you remember the uproar about addons being broken in Firefox 57? It was for good (security) reasons but many non-technical users don't understand or respect the pros and cons. All they see is their workflow being broken.
      - jacquesm 9y ago
        Even I as a technical user saw my workflow broken and to this day it hasn't been resolved. So point taken. Also: I'm not convinced that the FF57 reasons were as good as stated, it seemed mostly a case of 'we can therefore we do and here are some reasons to make you feel good'. A backwards compatibility switch to override the change would have been the least. Only Microsoft seems to really understand backwards compatibility.
        Sylos 9y ago
        > A backwards compatibility switch to override the change would have been the least. They changed so much in the code base which broke compatibility with the old system that they would have pretty much had to do a hard fork and include both Firefox versions into the download in order to provide this; pretty much doubling maintenance cost as well. On the flip side, they do now actually have an actual extension API, abstracting away from that code base, making it much more unlikely that such a breakage will be necessary in the future, and it especially also prevents those frequent smaller breakages that were commonplace with every new Firefox release up until 57.
      - dhimes 9y ago
        Yep. They are going to fire up Chrome, find it works, and go from there.
theossuary 9y ago
Even still it still passes along the domain, so that'd still be possible. I'd guess that nobody would need to validate past the domain (and/or subdomain) level.
Pxtl 9y ago
Any that we'd actually heard of?
wastedhours 9y ago
For things like small-time affiliate systems maybe?
CodeWriter23 9y ago
> Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people. You mean some websites that fail to employ the best practice of “don’t trust external input”. Yes that applies to easily-spoofed headers.
- tzakrajs 9y ago
  They don't rely on it for authentication alone, usually it's a secondary or tertiary method that can block a login.

deleted 9y ago

[deleted]

jacquesm 9y ago

Frankly: that's their problem. If your business model revolves around client side security then you have other problems.

deleted 9y ago
[deleted]
Fnoord 9y ago
I get what you're saying and I agree but it is a bit more nuanced. Say you want to read a certain news article, and if you get referred to it by Google you can read it, otherwise not. Now, lets say you've been finding news articles to read that way via Google the past years. Suddenly, with Firefox 59, this no longer works. Without even informing the user. That is not user-friendly.
- jacquesm 9y ago
  Sites should be penalized for giving preference to one kind of link over another. Why should Google have even more of an upper hand than they already have? To me this is a super good illustration of why we probably should get rid of the 'Referer' (sic) header altogether.
  - Fnoord 9y ago
    Agreed, but the short-term loser of this change is the non-technical customer who's workflow is suddenly broken, and only in Firefox, and only in version 59. Apparently only in Private Mode though which makes my use case probably less common. Thing is, do you remember the uproar about addons being broken in Firefox 57? It was for good (security) reasons but many non-technical users don't understand or respect the pros and cons. All they see is their workflow being broken.
    - jacquesm 9y ago
      Even I as a technical user saw my workflow broken and to this day it hasn't been resolved. So point taken. Also: I'm not convinced that the FF57 reasons were as good as stated, it seemed mostly a case of 'we can therefore we do and here are some reasons to make you feel good'. A backwards compatibility switch to override the change would have been the least. Only Microsoft seems to really understand backwards compatibility.
      - Sylos 9y ago
        > A backwards compatibility switch to override the change would have been the least. They changed so much in the code base which broke compatibility with the old system that they would have pretty much had to do a hard fork and include both Firefox versions into the download in order to provide this; pretty much doubling maintenance cost as well. On the flip side, they do now actually have an actual extension API, abstracting away from that code base, making it much more unlikely that such a breakage will be necessary in the future, and it especially also prevents those frequent smaller breakages that were commonplace with every new Firefox release up until 57.
    - dhimes 9y ago
      Yep. They are going to fire up Chrome, find it works, and go from there.

theossuary 9y ago

Even still it still passes along the domain, so that'd still be possible. I'd guess that nobody would need to validate past the domain (and/or subdomain) level.

Pxtl 9y ago

Any that we'd actually heard of?

wastedhours 9y ago

For things like small-time affiliate systems maybe?

CodeWriter23 9y ago

> Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people. You mean some websites that fail to employ the best practice of “don’t trust external input”. Yes that applies to easily-spoofed headers.

tzakrajs 9y ago
They don't rely on it for authentication alone, usually it's a secondary or tertiary method that can block a login.