4 ms·
In practice, this is not true. As for spec [0]: Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page wa
by thezilch 14y ago
In practice, this is not true. As for spec [0]:
Clients SHOULD NOT include a Referer header field in a (non-secure)
HTTP request if the referring page was transferred with a secure
protocol.
[0] http://tools.ietf.org/html/rfc2616#section-15.1.3 http://tools.ietf.org/html/rfc2616#section-15.1.3
- cpeterso 14y agoUnless I'm missing something, that section only addresses HTTPS -> HTTP referrals, not HTTPS -> HTTPS.
- thezilch 14y agoI don't know of such a section, there is simply a section on Referer[sic] request-headers [0], at large. HTTP -> HTTP and HTTPS -> HTTPS are implied, if the only stated consideration is HTTPS -> HTTP referrals. HTTPS -> HTTPS Referer works on Google Search, which is usually of the most concern. [0] http://tools.ietf.org/html/rfc2616#section-14.36 http://tools.ietf.org/html/rfc2616#section-14.36