5 ms·

So the question I have is how big of an impact is this going to have to online marketers? (Especially if Chrome/IE follow suit)

cpeterso 14y ago
They are unhappy because websites won't see HTTP Referer headers and will have to rely on Google's webmaster services to get referral stats: https://bugzilla.mozilla.org/show_bug.cgi?id=633773#c43 https://bugzilla.mozilla.org/show_bug.cgi?id=633773#c43
- mlinksva 14y ago
  Will they not see the referer header if their own sites (as indexed by Google) are https? If they don't switch, puts some sort of upper bound on how much they value the referer data. (User agents aren't supposed to send referer http->https but scratch above if practice is for them not to send https->https across domains as well.)
  - ComputerGuru 14y ago
    I don't know about the spec, but in practice, you never get the referer data even when traffic flows from HTTPS to HTTPS.
    - fl3tch 14y ago
      This is actually up to the client. In Firefox about:config, network.http.sendSecureXSiteReferrer is set to true by default, so it does send it, but you can turn it off.
      - tonfa 14y ago
        Google decides what the referrer is since it redirects first to a url it controls (downgrading to http if necessary).
    - thezilch 14y ago
      In practice, this is not true. As for spec [0]: Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol. [0] http://tools.ietf.org/html/rfc2616#section-15.1.3 http://tools.ietf.org/html/rfc2616#section-15.1.3
      - cpeterso 14y ago
        Unless I'm missing something, that section only addresses HTTPS -> HTTP referrals, not HTTPS -> HTTPS.
        thezilch 14y ago
        I don't know of such a section, there is simply a section on Referer[sic] request-headers [0], at large. HTTP -> HTTP and HTTPS -> HTTPS are implied, if the only stated consideration is HTTPS -> HTTP referrals. HTTPS -> HTTPS Referer works on Google Search, which is usually of the most concern. [0] http://tools.ietf.org/html/rfc2616#section-14.36 http://tools.ietf.org/html/rfc2616#section-14.36
    - yaix 14y ago
      Right. The article says this: "Additionally, using HTTPS helps providers like Google remove information from the referrer string."
      - tonfa 14y ago
        Yes, just checked, they strip the keywords from the referrer when using https.

cpeterso 14y ago

They are unhappy because websites won't see HTTP Referer headers and will have to rely on Google's webmaster services to get referral stats: https://bugzilla.mozilla.org/show_bug.cgi?id=633773#c43 https://bugzilla.mozilla.org/show_bug.cgi?id=633773#c43

mlinksva 14y ago
Will they not see the referer header if their own sites (as indexed by Google) are https? If they don't switch, puts some sort of upper bound on how much they value the referer data. (User agents aren't supposed to send referer http->https but scratch above if practice is for them not to send https->https across domains as well.)
- ComputerGuru 14y ago
  I don't know about the spec, but in practice, you never get the referer data even when traffic flows from HTTPS to HTTPS.
  - fl3tch 14y ago
    This is actually up to the client. In Firefox about:config, network.http.sendSecureXSiteReferrer is set to true by default, so it does send it, but you can turn it off.
    - tonfa 14y ago
      Google decides what the referrer is since it redirects first to a url it controls (downgrading to http if necessary).
  - thezilch 14y ago
    In practice, this is not true. As for spec [0]: Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol. [0] http://tools.ietf.org/html/rfc2616#section-15.1.3 http://tools.ietf.org/html/rfc2616#section-15.1.3
    - cpeterso 14y ago
      Unless I'm missing something, that section only addresses HTTPS -> HTTP referrals, not HTTPS -> HTTPS.
      - thezilch 14y ago
        I don't know of such a section, there is simply a section on Referer[sic] request-headers [0], at large. HTTP -> HTTP and HTTPS -> HTTPS are implied, if the only stated consideration is HTTPS -> HTTP referrals. HTTPS -> HTTPS Referer works on Google Search, which is usually of the most concern. [0] http://tools.ietf.org/html/rfc2616#section-14.36 http://tools.ietf.org/html/rfc2616#section-14.36
  - yaix 14y ago
    Right. The article says this: "Additionally, using HTTPS helps providers like Google remove information from the referrer string."
    - tonfa 14y ago
      Yes, just checked, they strip the keywords from the referrer when using https.