3 ms·

The real shame is why the linked page even gets referral information at all (and why we cannot disable it on a browser)... I'd love to have a browser setting t

The real shame is why the linked page even gets referral information at all (and why we cannot disable it on a browser)... I'd love to have a browser setting to just completely disable "Referer:" headers and blank out `document.referrer`. Like, clearly hosts can control referral information to high granularity (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...) but why can't users... (actually apparently you can set this for Firefox)

ilikehurdles 4y ago
I agree. I’m surprised Safari of all browsers doesn’t at least provide an option to obscure this.
snovv_crash 4y ago
At least for cross-domain URLs. Within a domain I could understand context, back buttons etc being useful.
- flas9sd 4y ago
  firefox has 'network.http.referer.XOriginPolicy' to send referer depending on domain 0 - no restrictions (default), 1 - base domain match, 2 - fqdn match
- jabbany 4y ago
  Useful how? Within a domain/origin you can already track/control this stuff with a plethora of things: cookies, URL params, localStorage, JS access of history to implement fancy back behavior...
  - snovv_crash 4y ago
    Exactly, so it isn't a security/privacy leak, so there's no harm in leaving it on.
    - jabbany 4y ago
      No, the other forms require sites to opt-in whereas this just sends the information whether the site wants/needs it or not. There is plenty of harm in just this fact alone, because tracking via the other methods is transparent: you know sites are doing internal tracking if you see them being used. With referral information sent by default you have no idea whether the site uses the information or just ignores it. Either way the important thing shouldn't be how much referral information should be sent (because clearly people disagree on that). Rather all browsers should let you customize this if you want to.

ilikehurdles 4y ago

I agree. I’m surprised Safari of all browsers doesn’t at least provide an option to obscure this.

snovv_crash 4y ago

At least for cross-domain URLs. Within a domain I could understand context, back buttons etc being useful.

flas9sd 4y ago
firefox has 'network.http.referer.XOriginPolicy' to send referer depending on domain 0 - no restrictions (default), 1 - base domain match, 2 - fqdn match
jabbany 4y ago
Useful how? Within a domain/origin you can already track/control this stuff with a plethora of things: cookies, URL params, localStorage, JS access of history to implement fancy back behavior...
- snovv_crash 4y ago
  Exactly, so it isn't a security/privacy leak, so there's no harm in leaving it on.
  - jabbany 4y ago
    No, the other forms require sites to opt-in whereas this just sends the information whether the site wants/needs it or not. There is plenty of harm in just this fact alone, because tracking via the other methods is transparent: you know sites are doing internal tracking if you see them being used. With referral information sent by default you have no idea whether the site uses the information or just ignores it. Either way the important thing shouldn't be how much referral information should be sent (because clearly people disagree on that). Rather all browsers should let you customize this if you want to.