4 ms·
One item that this (excellent) blog post does not adress is what to do about referer information which is generally not passed along when clicking on links on s
by harryh 15y ago
One item that this (excellent) blog post does not adress is what to do about referer information which is generally not passed along when clicking on links on sites being browsed over SSL.
In order to "get credit" for all of the traffic that they send everywhere twitter had to develop a fairly elaborate system of redirections (built into t.co) to make sure that clicks from twitter.com ended up being sent out to the rest of the web with referer information.
It would be a real shame if everyone in the world had to develop a similar process.
Part of me thinks that browsers should start sending referer information even when you click on links for SSL sites, though this change would bring with it other problems.
It is not at all obvious (to me at least) what that best thing to do here is.
- mkjones 15y agoYeah, this is a bit of a pain. We have to something similar for facebook (https://www.facebook.com/note.php?note_id=10150492832835766 https://www.facebook.com/note.php?note_id=10150492832835766). There's talk of a meta referrer tag (http://wiki.whatwg.org/wiki/Meta_referrer http://wiki.whatwg.org/wiki/Meta_referrer) that would allow overriding this behavior and making things a lot simpler, but afaik it's not implemented in any of the major browsers.
- wladimir 15y agoWhen going from https to https site, referer information is usually being sent, at least with modern browsers. So if the whole web goes encrypted (yay), the issue is solved.
- harryh 15y agoReally? That's....very strange. The rules for this sort of thing seem so arbitrary.
- wladimir 15y agoIt makes a little bit of sense. When you come from a https site, you don't want to leak referrer (and thus which part of which site you were visiting) over the unencrypted internet. Though in my eyes sending referrers always has been questionable "insecure by default" behavior, as the internal structure of one site is leaked to another. With hindsight, maybe it should have been restricted to the domain name.
- mike-cardwell 15y agoIf HTTP referrers never existed, the web would still be huge and would still be full of amazing content. Why should we care about retaining referrers? I think the only reason that people dislike the idea of losing them, is because they've got used to them being there. I don't particularly like the fact that sites which I click through to can see where I'm coming from, or what I was searching for, so I've installed a Firefox addon called RefControl to get around it. The majority of people don't know anything about referrers though. I'm sure that brick and mortar shops would also love to know how I was referred to them when I walk through their door. They don't get this information unless I consciously decide to give it to them though. And even though they don't get this information, they still manage to sell products.
- alexchamberlain 15y agoInertia shouldn't stop us doing something. Where a visitor comes from is very valuable (not just monetarily), and I don't think it really infringes on privacy.
- mike-cardwell 15y agoIt absolutely does infringe on privacy. The only thing that is up for question is by how much and if the benefits outweigh the drawbacks. People who benefit from them existing are obviously going to have a different view point to everyone else (on average). I don't think that referrers should ever have been a part of the protocol and I don't think that the commercial value of them existing should have any influence on whether or not HTTP continues to include them. Unfortunately, both Google and Microsoft benefit financially from the existence of referrer headers, so I don't see them going anywhere in Chrome or IE at least.
- rmc 15y agoReferrer information allows website owners to see who is linking to their site. It's like a private, reverse form of <a> tags
- mike-cardwell 15y ago