4 ms·
Some websites would whitelist referrers to prevent hotlinking resources from other websites (incurring potentially high bandwidth costs). But overall I'm all f
by simias 6y ago
Some websites would whitelist referrers to prevent hotlinking resources from other websites (incurring potentially high bandwidth costs).
But overall I'm all for getting rid of it. It's a remnant of the early web that doesn't make a lot of sense these days, and creates more problems than it solves.
EDIT: Although I just realized that strict-origin-when-cross-origin (the new policy) would still let the hotlinking detection use case work, since you typically only need domain information for that. I initially thought that they would use same-origin or something like that. It'll teach me to comment before I read the linked story.
- calvinmorrison 6y agoVictorOps uses referrers as a "security measure" on login. So I just have a separate profile of firefox without my antireferrer addon
- ignoramous 6y ago> VictorOps uses referrers as a "security measure" on login. Using the referrer header as a security and privacy measure is prevalent among service providers. Vimeo even hilariously charges for this feature which is trivially bypassed; and I'd reckon their paying customers aren't even aware of it: https://vimeo.zendesk.com/hc/en-us/articles/224819527-Changing-the-privacy-settings-of-your-videos https://vimeo.zendesk.com/hc/en-us/articles/224819527-Changi... Talk about smoke and mirrors.
- judge2020 6y agoMaybe they advertise it as a security feature but it's still a good way to prevent unauthorized hotlinking that burns your vimeo bandwidth, costing you money (assuming it does indeed prevent random websites from embedding your videos).
- monkeybutton 6y agoThis reminds me of some vague memories of a time long ago where some websites had a secure login page that asks for a username&pw but every other page after just checked the referall header. It wasn't a very secure system and people shared the header values needed to bypass logging in.
- antonvs 6y agoThat's basically a degenerate form of capability-based security. Sharing the referrer header is delegating access rights. Of course, that's not actually a property you want in this case.
- fluidcruft 6y agoI've started to see quite a bit of that on websites dealing with transfer of medical data. I figured it was probably some sort of an effort to handicap MITM potential of impostor websites that were trying to steal credentials. My theory is that it might be some sort of a tripwire for the website to detect fishiness and lock the account.
- guywhocodes 6y agoTwitter does this and more
- spicybright 6y agoI can't think of a single use case where a user would want a target site to know where they came from. Put that in the URL or something less nefarious if you want to communicate state.