6 ms·

Create an anonymous link that will hide the HTTP Referer header

19 points by modinfo 6y ago

loige 6y ago
Brilliant idea!
- code-is-code 6y ago
  No, just dangerous for your users.
bigoldie 6y ago
Kudos for the name, but this isn't the first service to provide this.
vizzah 6y ago
It uses "<meta name="referrer" content="no-referrer" />". Not all browsers will respect that.
- onion2k 6y ago
  I'm not aware of any browser since IE10, and some versions of IE11, that don't. https://caniuse.com/rel-noreferrer https://caniuse.com/rel-noreferrer
  - livre 6y ago
    That's for the link element, this is for meta https://caniuse.com/mdn-html_elements_meta_name_referrer https://caniuse.com/mdn-html_elements_meta_name_referrer
vince14 6y ago
<a referrerpolicy="no-referrer"></a>
- edoceo 6y ago
  I thought its rel=noreferrer that's what MDN has
  - tyingq 6y ago
    It shows both: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#integration_with_html https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
    - edoceo 6y ago
      Huh. Thanks, I was just looking there yesterday and I'm sure I didn't see the other option. I gotta check my history, see if I'm losing my mind.
- vizzah 6y ago
  Shared as URL, will not use <A> tag for the redirect, but "<meta>" tag, which isn't that well supported.
code-is-code 6y ago
This is so dangerous to use. There have been hundrets of these sites in the past. As soon as they have enough traffic they silently redirect or change affiliate ids etc. Do not use them, the rel=noreferer is good enough.
minitech 6y ago
Share people’s Referer, destination, and control over their destination with a random third party that may or may not be around in the future :)
londons_explore 6y ago
HTTPS doesn't give referrers anyway... Most of the web is HTTPS now, so why does this matter?
- vince14 6y ago
  The destination site still receives the referrer header, sent by your browser via HTTPS. Further measures are needed like this one.
  - londons_explore 6y ago
    You're mistaken. MdN says: strict-origin-when-cross-origin (default) Send the origin, path, and querystring when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS). So no path is sent to the destination of a link over https - only the domain.
    - vince14 6y ago
      You left out the part which contradicts your claim. > Don't send the Referer header to less secure destinations (HTTPS→HTTP). The referer header is still sent from HTTPS to HTTPS.
      - londons_explore 6y ago
        Yes, but only with the domain not the full path. Does anyone really care that the domain is leaked? There are very few secret domains...
ddevault 6y ago
Though it's not entirely in the spirit of the HN guidelines, I find it reasonble to flag dangerous content. I've done so for this post, and I would advise onlookers to do the same.

19 points by modinfo 6y ago

loige 6y ago

Brilliant idea!

code-is-code 6y ago
No, just dangerous for your users.

bigoldie 6y ago

Kudos for the name, but this isn't the first service to provide this.

vizzah 6y ago

It uses "<meta name="referrer" content="no-referrer" />". Not all browsers will respect that.

onion2k 6y ago
I'm not aware of any browser since IE10, and some versions of IE11, that don't. https://caniuse.com/rel-noreferrer https://caniuse.com/rel-noreferrer
- livre 6y ago
  That's for the link element, this is for meta https://caniuse.com/mdn-html_elements_meta_name_referrer https://caniuse.com/mdn-html_elements_meta_name_referrer

vince14 6y ago

edoceo 6y ago
I thought its rel=noreferrer that's what MDN has
- tyingq 6y ago
  It shows both: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#integration_with_html https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
  - edoceo 6y ago
    Huh. Thanks, I was just looking there yesterday and I'm sure I didn't see the other option. I gotta check my history, see if I'm losing my mind.
vizzah 6y ago
Shared as URL, will not use <A> tag for the redirect, but "<meta>" tag, which isn't that well supported.

code-is-code 6y ago

This is so dangerous to use. There have been hundrets of these sites in the past. As soon as they have enough traffic they silently redirect or change affiliate ids etc. Do not use them, the rel=noreferer is good enough.

minitech 6y ago

Share people’s Referer, destination, and control over their destination with a random third party that may or may not be around in the future :)

londons_explore 6y ago

HTTPS doesn't give referrers anyway... Most of the web is HTTPS now, so why does this matter?

vince14 6y ago
The destination site still receives the referrer header, sent by your browser via HTTPS. Further measures are needed like this one.
- londons_explore 6y ago
  You're mistaken. MdN says: strict-origin-when-cross-origin (default) Send the origin, path, and querystring when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS). So no path is sent to the destination of a link over https - only the domain.
  - vince14 6y ago
    You left out the part which contradicts your claim. > Don't send the Referer header to less secure destinations (HTTPS→HTTP). The referer header is still sent from HTTPS to HTTPS.
    - londons_explore 6y ago
      Yes, but only with the domain not the full path. Does anyone really care that the domain is leaked? There are very few secret domains...

ddevault 6y ago

Though it's not entirely in the spirit of the HN guidelines, I find it reasonble to flag dangerous content. I've done so for this post, and I would advise onlookers to do the same.