3 ms·
The reason for the intermediary is because the clickthrough sends the previous URL as a referer to the next server. The only real way to avoid leaking specific
by esrauch 10mo ago
The reason for the intermediary is because the clickthrough sends the previous URL as a referer to the next server.
The only real way to avoid leaking specific urls from the source page to the arbitrary other server is to have an intermediary redirect like this.
All the big products put an intermediary for that reason, though many of them make it a user visible page of that says "you are leaving our product" versus Google mostly does it as an immediate redirect.
The copy/paste behavior is mostly an unfortunate side effect and not a deliberate feature of it.
- afandian 10mo agoI don't understand. They are redirecting to their own S3 bucket, so who would be the recipient of the leak? Also, isn't this what Referrer-Policy is for? https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
- giancarlostoro 10mo agoQuoting web standards, you are more optimistic than I am, unfortunately, nobody uses them consistently or accurately (look at PUT vs POST for create / update as a really good example of this - nobody agrees) its a shame too, there's a lot of richness to the web spec. Most people don't even use "HEAD" to ensure they aren't making wasteful REST calls if they already have the data.
- afandian 10mo agoI was replying to > All the big products put an intermediary for that reason Surely whoever maintains the big products can add headers if they want? And this is about people who care enough about not showing up in Referer headers to do something about it rather than people in general not understanding the full spec .
- giancarlostoro 10mo agoThe other problem is if you're too big like Google, you cannot assume everyone will honor this, which is why they do these redirects.
- afandian 10mo agoReferrer-Policy is a response header, so in this case it would be Google sending it, and the browsers who would be honouring it. You have to hope that the browser makers get it correct... Unless I misunderstood?
- esrauch 10mo agoI worked on these big web products before and the answer then was that no, you couldn't trust it to be honored and it would have been considered a privacy incident so better off just having the redirect and having no risk. You can't trust the useragents for example. Not sure if the reliability of the intentional mechanism has improved enough where this is just legacy or if there's entirely new reasons for it in 2026.
- otterley 10mo agoBlogger predates the existence of this header by many years. Blogger, I believe, has also been in maintenance mode for many years.
- Kye 10mo agoIt sees periodic major updates to keep it in line with standards. That's not much more than maintenance mode, but it's more than just keeping the servers running. It seems like someone at Google pays attention to it and keeps it from falling behind, but I suspect the same was true of Google Reader until it wasn't.
- reddalo 10mo ago>someone at Google pays attention to it and keeps it from falling behind I feel like it's the same for Google My Maps. They even discontinued the Android app, so you can only use it on the web. It totally feels like there's a single guy keeping the whole system up.