3 ms·
> Is there any story about anyone affected by the issue? Does this issue even exist Yes. Yes it does. Imagine, a web site that has a query parameter with a se
by Ayesh 6y ago
> Is there any story about anyone affected by the issue? Does this issue even exist
Yes. Yes it does.
Imagine, a web site that has a query parameter with a secret (password reset pages, email unsubscribe, custom feeds, etc). Any images or other assets used in the page will receive the full URL as the referrer, so they can see those secrets.
GitHub fixed this very issue a few years ago. They have a feature to get custom RSS feeds for user activity. There is a secret worry parameter in the URL, and any third party images were receiving that full URL.
Referrer-Policy header is already supported in many browsers.
- fvv 6y agoIf it's a page that contain or receive secret should be using https where referrer is already stripped off
- jefftk 6y agoFirefox was using no-referrer-when-downgrade, which only strips refers when navigating from HTTPS to HTTP. They are switching to strict-origin-when-cross-origin, which cuts the referrer down to just the origin when navigating to a different origin.
- tomaszs 6y agoSo where is a real life example?