4 ms·

Client HTTP header I don't want: * referer * user-agent Happy to be wrong, but these shouldn't be mandatory to browse the web, which they kind of are.

• gtirloni 8y ago
  I too would like a world where all browsers implemented fully the same standard but that's not how it worked out (or it ever works). This is an amusing (scary?) article about the history of the user-agent: https://webaim.org/blog/user-agent-string-history/ https://webaim.org/blog/user-agent-string-history/
  • maxk42 8y ago
    Yes but you should be testing browser capabilities not user agents.
    • gtirloni 8y ago
      Totally agree. https://developer.mozilla.org/en-US/docs/Web/HTTP/Browser_detection_using_the_user_agent https://developer.mozilla.org/en-US/docs/Web/HTTP/Browser_de...
    • mattmanser 8y ago
      The requires more steps and a slower process. User-agent is a one step process. Browser capabilities means returning something back to the browser and potentially coming back to the server. While it has obviously been abused, neither way is ideal. There's no way for a server to say "tell me the browser capabilities before I serve you the request".
• jaytaylor 8y ago
  Note: I've also written about this on my site with more notes and context: https://jaytaylor.com/writeups/2018/why-referrer-header-empty-nowadays.html https://jaytaylor.com/writeups/2018/why-referrer-header-empt... -- Short version: These days the referrer header rarely makes it through for 2 main classes of reasons [0]. 1. Requests transiting across HTTP <-> HTTPS boundaries do not include the referrer header. 2. The referrer header is frequently disabled by sites (especially search engines and high-traffic sites) through the use a special HTML header meta control tag [1]: <meta name="referrer" content="no-referrer" /> Worry not, though. When client-side Javascript is enabled, ga.js still sends enough information that Google can reconstruct most of everyone's browsing sessions on their backend. Now Google (and only Google) really has all your / our data (generally speaking). :-\ [1] https://stackoverflow.com/questions/6880659/in-what-cases-will-http-referer-be-empty https://stackoverflow.com/questions/6880659/in-what-cases-wi... [0] https://stackoverflow.com/questions/6817595/remove-http-referer https://stackoverflow.com/questions/6817595/remove-http-refe...
  • LaGrange 8y ago
    > ga.js still sends enough information that Google can reconstruct most of everyone's browsing sessions on their backend. Every time someone asks me to add GA to a website I get a little bit more bitter.
• realusername 8y ago
  I would be happy to do the same but there's just some browser bugs I have to fix by reading the User-Agent...
• gboudrias 8y ago
  I used to spoof my user-agent and don't remember much of a difference... As a dev, everyone tells me I should just throw literally every possible version of newer attributes into the CSS anyhow, so on most websites you're bound to get at least some of the right ones. Perhaps your complaint is of a higher order though? Recently I've been spending most of my time wrestling with CSS so my perspective is a bit skewed...
• dewiz 8y ago
  for instance, just found today that GitHub code reviews require the Referer header to allow PR comments. Without the Referer header, GH returns `422 Unprocessable Entity`