5 ms·

Hmm. I thought browsers stopped giving out referrer years ago ... !?

by z3t4 8y ago

judge2020 8y ago
I've seen social networks use noreferrer on their links, but they're still a browser feature nonetheless. Referrers are also always sent for image tags and remote resources.
mbell 8y ago
There are options to control the referrer in various places, but it is still included by default. The only situation I can think of where its blocked by default is when navigating from https to http.
- lixtra 8y ago
  Which seems to happen here: https://news.ycombinator.com/item?id=19295836 https://news.ycombinator.com/item?id=19295836 -> http://sbjs.rocks/#/ http://sbjs.rocks/#/
lixtra 8y ago
In particular: “A user agent must not send a referrer header field in an unsecured HTTP request if the referring page was received with a secure protocol” https://tools.ietf.org/html/rfc7231#section-5.5.2 https://tools.ietf.org/html/rfc7231#section-5.5.2
Theodores 8y ago
No, however, the idea is that if the link is target _blank then you are supposed to add a rel attribute, commonly given as rel="noopener noreferrer" in most articles you read. Common content management systems such as Wordpress and Drupal do this for you. Nobody has yet died due to some programmer carelessly not having 'noreferrer' set in the 'rel' attribute of a link that opens in another tab but, if you want to get 100% on Google's Lighthouse audit tool, then it really does matter. The Google article is worth the read as it makes it clear that the oft-cited rel="noopener noreferrer" is wrong. The thing is that 'noreferrer' is a superset of 'noopener' so you only actually need rel="noreferrer" without the 'noopener' bit. The 'opener' said no to is 'window.opener' in Javascript. This probably was brilliant in the days of frames and has lurked in the specs ever since. https://developers.google.com/web/tools/lighthouse/audits/noopener https://developers.google.com/web/tools/lighthouse/audits/no...
baroffoos 8y ago
I think that was just cutting off the path from the referrer data.

Hmm. I thought browsers stopped giving out referrer years ago ... !?

by z3t4 8y ago

Hmm. I thought browsers stopped giving out referrer years ago ... !?

judge2020 8y ago

I've seen social networks use noreferrer on their links, but they're still a browser feature nonetheless. Referrers are also always sent for image tags and remote resources.

mbell 8y ago

There are options to control the referrer in various places, but it is still included by default. The only situation I can think of where its blocked by default is when navigating from https to http.

lixtra 8y ago
Which seems to happen here: https://news.ycombinator.com/item?id=19295836 https://news.ycombinator.com/item?id=19295836 -> http://sbjs.rocks/#/ http://sbjs.rocks/#/

lixtra 8y ago

In particular: “A user agent must not send a referrer header field in an unsecured HTTP request if the referring page was received with a secure protocol” https://tools.ietf.org/html/rfc7231#section-5.5.2 https://tools.ietf.org/html/rfc7231#section-5.5.2

Theodores 8y ago

No, however, the idea is that if the link is target _blank then you are supposed to add a rel attribute, commonly given as rel="noopener noreferrer" in most articles you read. Common content management systems such as Wordpress and Drupal do this for you. Nobody has yet died due to some programmer carelessly not having 'noreferrer' set in the 'rel' attribute of a link that opens in another tab but, if you want to get 100% on Google's Lighthouse audit tool, then it really does matter. The Google article is worth the read as it makes it clear that the oft-cited rel="noopener noreferrer" is wrong. The thing is that 'noreferrer' is a superset of 'noopener' so you only actually need rel="noreferrer" without the 'noopener' bit. The 'opener' said no to is 'window.opener' in Javascript. This probably was brilliant in the days of frames and has lurked in the specs ever since. https://developers.google.com/web/tools/lighthouse/audits/noopener https://developers.google.com/web/tools/lighthouse/audits/no...

baroffoos 8y ago

I think that was just cutting off the path from the referrer data.