5 ms·

It genuinely shocks me that there are still people who don't disable sending the referer header cross-origin in the browser: I have not encountered a single web

It genuinely shocks me that there are still people who don't disable sending the referer header cross-origin in the browser: I have not encountered a single website that breaks when setting `network.http.referer.XOriginPolicy` to 1 in Firefox, and only 2 or 3 sites that break when setting it all the way to 2. It not only completely prevents stuff like this, it profoundly increases your privacy on the web by preventing sites from tracking which domain you came from. There is no good reason any site needs to know that. I am surprised that Mozilla hasn't simply made this the default setting for all users.

deleted 5y ago
[deleted]
postingposts 5y ago
I think people don’t know about it. I’m going to do this now that I do. Thank you!
brigandish 5y ago
> I am surprised that Mozilla hasn't simply made this the default setting for all users. I was under the impression it was, I doubt I'm the only one, so thanks for drawing attention to it.
caslon 5y ago
The Wayback Machine interface breaks.
- bscphil 5y ago
  Do you have an example of this? What exactly breaks? I use Wayback all the time and have had no obvious problems.
  - caslon 5y ago
    Has been the case for a bunch of people with them turned off for a while now: https://old.reddit.com/r/WaybackMachine/comments/kzvzxl/fail_with_status_498_no_reason_phrase_error/ https://old.reddit.com/r/WaybackMachine/comments/kzvzxl/fail...
    - bscphil 5y ago
      Unless I'm mistaken, you've misunderstood the issue. From your link: > it happened to me and I figured out it started when I disabled website.referrersEnabled So if you completely disable sending the referer header, it breaks. This would probably also happen if you set `network.http.sendRefererHeader` to 0 or 1. But that's not what I suggested! I only suggested disabling sending the header externally, to other sites, when the host domain (*.example.org) changes. In fact, someone in the thread you linked says that doing this instead of disabling it completely fixed the issue for them: > ok I left network.http.sendRefererHeader on 2 (had it on 1), and changing network.http.referer.XOriginPolicy to 2 it works
cinquemb 5y ago
There is also `network.http.referer.spoofSource`, which I have used instead of that.
- bscphil 5y ago
  This breaks in the case that the endpoint actually does use the referer for something. I have actually encountered plenty of cases where a site will use the referer internally, i.e. on the same origin, to check something.
  - cinquemb 5y ago
    Yeah that's fair, but I haven't really noticed it for myself, but then again, I disable javascript by default and have compiled a lot of other stuff into the netwerk module that probably breaks sites even more to the degree if its noticeable, i just don't use the site.
ReallyOldLurker 5y ago
>> `network.http.referer.XOriginPolicy` to 1 in Firefox Thanks! Just checked and it is at zero for the default. Reviewed https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer and learned something new.

deleted 5y ago

[deleted]

postingposts 5y ago

I think people don’t know about it. I’m going to do this now that I do. Thank you!

brigandish 5y ago

> I am surprised that Mozilla hasn't simply made this the default setting for all users. I was under the impression it was, I doubt I'm the only one, so thanks for drawing attention to it.

caslon 5y ago

The Wayback Machine interface breaks.

bscphil 5y ago
Do you have an example of this? What exactly breaks? I use Wayback all the time and have had no obvious problems.
- caslon 5y ago
  Has been the case for a bunch of people with them turned off for a while now: https://old.reddit.com/r/WaybackMachine/comments/kzvzxl/fail_with_status_498_no_reason_phrase_error/ https://old.reddit.com/r/WaybackMachine/comments/kzvzxl/fail...
  - bscphil 5y ago
    Unless I'm mistaken, you've misunderstood the issue. From your link: > it happened to me and I figured out it started when I disabled website.referrersEnabled So if you completely disable sending the referer header, it breaks. This would probably also happen if you set `network.http.sendRefererHeader` to 0 or 1. But that's not what I suggested! I only suggested disabling sending the header externally, to other sites, when the host domain (*.example.org) changes. In fact, someone in the thread you linked says that doing this instead of disabling it completely fixed the issue for them: > ok I left network.http.sendRefererHeader on 2 (had it on 1), and changing network.http.referer.XOriginPolicy to 2 it works

cinquemb 5y ago

There is also `network.http.referer.spoofSource`, which I have used instead of that.

bscphil 5y ago
This breaks in the case that the endpoint actually does use the referer for something. I have actually encountered plenty of cases where a site will use the referer internally, i.e. on the same origin, to check something.
- cinquemb 5y ago
  Yeah that's fair, but I haven't really noticed it for myself, but then again, I disable javascript by default and have compiled a lot of other stuff into the netwerk module that probably breaks sites even more to the degree if its noticeable, i just don't use the site.

ReallyOldLurker 5y ago

>> `network.http.referer.XOriginPolicy` to 1 in Firefox Thanks! Just checked and it is at zero for the default. Reviewed https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer and learned something new.