3 ms·
Doesn't it also say not to send refer data to different domains? I'm trying to find docs for that. EDIT: https://bugzilla.mozilla.org/show_bug.cgi?id=141641 h
by jimktrains2 14y ago
Doesn't it also say not to send refer data to different domains? I'm trying to find docs for that.
EDIT: https://bugzilla.mozilla.org/show_bug.cgi?id=141641 https://bugzilla.mozilla.org/show_bug.cgi?id=141641 Maybe I'm wrong but that seems to be what some browsers do/did.
- deleted 14y ago[deleted]
- olalonde 14y agoSending referer data to different domains is always allowed for non-secure URLs (otherwise, web analytics would be pretty boring). For secure URLs however, the browser should only send referer data if the destination page is also secure, regardless of domain.
- dmayle 14y agoThat makes no sense, and defeats some of the protection of SSL. If you're on a secure site, there should be no referrer sent cross-domain, or cross-protocol.
- entropy_ 14y agoI makes some sense. If you're using SSL and someone is trying to snoop on your connection. If you visit a non-SSL site from an SSL site and the referrer gets sent then the snooper knows the URL of the page you were on last. Whereas if the target site is SSL then no information is leaked to listeners. The point of SSL is to protect from snooping, not as a general privacy-protection mechanism that should have everything privacy-related shoehorned into it.