2 ms·
It can be fixed through a double redirect. Basically, redirect the browser to a internal page that redirects to the original page and have that page redirect to
by buddydvd 15y ago
It can be fixed through a double redirect. Basically, redirect the browser to a internal page that redirects to the original page and have that page redirect to the outbound link.
For example:
Say you're on this page: http://site.com/article?_uid=123 http://site.com/article?_uid=123 (_uid being the identity leaking query param)
and clicked a link that appears to point to: http://google.com/ http://google.com/
When a user clicks on that link, the page redirect the user to http://site.com/redirect?target=http%3A%2F%2Fgoogle.com&src=http%3A%2F%2Fsite.com%2Farticle http://site.com/redirect?target=http%3A%2F%2Fgoogle.com&...
The server will then redirect the browser back to: http://site.com/article http://site.com/article
And when the server sees that request with referrer set to /redirect?target=http%3A%2F%2Fgoogle.com, it will then parse out the target url and redirect the browser to http://google.com http://google.com.
This way, the target url can be given a meaningful referrer url without compromising user's identity.
- mkjones 15y agoIsn't that exactly what Quora is doing?
- buddydvd 15y agoOP's blog post says Quora is not doing that. It says Quora's redirecting to gigaom.com from http://www.quora.com/_/redirect?url=http%3A%2F%2Fgigaom.com%2F2010%2F06%2F08%2Fhow-zynga-survived-farmville%2F&sig=4f01ab http://www.quora.com/_/redirect?url=http%3A%2F%2Fgigaom.com%... instead of http://www.quora.com/What-are-everyday-apps-that-use-cloud-computing http://www.quora.com/What-are-everyday-apps-that-use-cloud-c.... The technique I described allows Quora to customize the referrer associated with an outbound link.
- mkjones 15y agoAh yes, I misread your post. The trouble with that approach is that you have to enumerate the dangerous params, and if the actual page URL needs a private parameter to work, you can't get rid of it.
- buddydvd 15y agoRight, but you can always pass the canonical url to the redirector. That lets you avoid maintaining a whitelist/blacklist of query params. This should be trivial for Quora as most of their pages already contain the meta tag specifying the canonical url: <link rel="canonical" href="http://www.quora.com/What-are-everyday-apps-that-use-cloud-computing" /> They just need to update their outbound link interceptor to take that version instead of the actual url.