4 ms·
Turning off HTTP_REFERER doesn't sound like a very good idea. How would you be able to tell how people found you? Knowing what link someone came in from is a gr
by dools 16y ago
Turning off HTTP_REFERER doesn't sound like a very good idea. How would you be able to tell how people found you? Knowing what link someone came in from is a great way to see where your site fits into this world wide web of ours.
It sounds to me as if the only issue is 3rd party ad networks. The antidote to this seems to me to be more reasonably the web browser's jurisdiction, ie. making the cookie policy more restrictive by default.
- dauphin 16y ago*referrer
- jarek 16y agoHeh, no. The header really is "HTTP_REFERER", and is somewhat notorious for the misspelling.
- dauphin 16y agoOpen an English dictionary (the Oxford one if you're serious), and come back. Note my fault if tbl didn't know how to speak English corectly backed then.
- jarek 16y agoSurely whether or not the RFC's authors know how to spell a word has no bearing on how sensible it is to correct the spelling of "HTTP_REFERER"? I mean, if dools had said "HTTP referer" then you might have had a point, but "HTTP_REFERER" unambiguously refers to the name of the header field.
- dools 16y agoIt's actually spelled HTTP_REFERER in the PHP $_SERVER superglobal :) edit: oops, I see someone beat me to it!
- jarek 16y agoIt's not just PHP - the HTTP 1.0 specification in RFC 1945 spells it like that.
- deleted 16y ago[deleted]
- gnaritas 16y agoSorry, accidental downvote while highlighting your question. > Turning off HTTP_REFERER doesn't sound like a very good idea. How would you be able to tell how people found you? And what if people in general, by default, don't want you to know that and we just got it wrong by default in the browser?
- dools 16y agoI don't remember anyone ever discussing the referrer as being an issue before 3rd party ad networks became so prevalent. This type of tracking exists for loads of other types of marketing, too. Promo codes, questionnaires that say "where did you find us?" and things like that. Above all, there's nothing a website can do maliciously with that information alone. An IP address and the page you came in from, that's all there is. The only thing of concern is a feature being provided by the browser which allows spammer.com to write to a cookie that was created by facebook.com right? I think that sending around the referrer is a necessary part of the interconnectedness of the web. I've noticed in my referral strings before that other bloggers have linked to articles which I wrote, then I've stopped past that blogger's site to have a read of their stuff. I've noticed a sharp rise recently in services making use of 3rd party cookies, though: FB connect and OAuth generally, and all of Google's stuff (I use a separate browser to stay logged into gmail and calendar so that I'm not logged in as far as Google is concerned for my normal browsing). What about having sandboxed browser instances which segment off your various web apps in their own little silos?
- bruceboughton 16y agoOAuth doesn't use cookies, does it?
- dools 16y agoNo, you're right it doesn't. But when you sign in with the same identity around the place, that identity is then stored in lots of different places so my perception of being "tracked" has certainly increased with the advent of OAuth.