3 ms·
People talk about Referer constantly in privacy-related fora, the problem is that there's also still an enormous numbers of sites which will break if it's disab
by morelisp 5y ago
People talk about Referer constantly in privacy-related fora, the problem is that there's also still an enormous numbers of sites which will break if it's disabled. Browsers have gradually stripped it down to just the origin, and I expect we'll see it disappear entirely in non-same-origin non-TLS situations eventually, but there's not much more they can do by default.
- bryans 5y ago> Browsers have gradually stripped it down to just the origin The big caveat is that the new browser policies will only default to origin if the website didn't specify the header, which means the website owner is still in control of whether it gets shared with the third party.
- morelisp 5y agoIf you mean the originating website, it could send its own URL in any header or parameter, so masking its ability to set Referer would be useless without also some complex supporting feature like ITP / Privacy Budget.