3 ms·
Ensure the "tweet this" or "like this" button does not generate a request to the 3rd party site simply by loading the Mozilla webpage the button is on (e.g. no
by darrikmazey 15y ago
Ensure the "tweet this" or "like this" button does not generate a request to the 3rd party site simply by loading the Mozilla webpage the button is on (e.g. no requests to third party site without user's intent via clicking on the button).
Thank you for this.
- justincormack 15y agoMost GET requests to third part sites are fine, you need to be more precise.
- darrikmazey 15y agoA GET request for an embedded resource exposes the user's cookies for that domain and associates a user of one site as a user of another. This is fine when it is at the user's explicitly intended request, but when paired with certain sites known not to delete all cookies on logout, this is nefarious and should not be done.
- zobzu 15y agoI'm not sure you can do this without voiding the agreement with twitter/facebook unfortunately. I'd suggest the use of Ghostery (works on all major browsers) on the client side, and on the server site, well, you know, not use any like button :>
- skymt 15y agoHeise Online worked out a solution[0]: a two-click Like button. The first click replaces a placeholder with the official Facebook Like button. Facebook objected at first, but only because Heise tried to make their placeholder look official. A quick design change allowed them to keep it. [0]: http://news.ycombinator.com/item?id=2957119 http://news.ycombinator.com/item?id=2957119
- zobzu 15y agoYeah that's why I'm not sure. It could be attacked depending on the country I guess, and if you don't use a facebook-like icon, its hard to tell what you're going to like. Debatable I guess
- cowboyhero 15y agotwitter allows custom links/ buttons. These don't require on-loading JavaScript or any calls to their services.