3 ms·

For the privacy of the user, nowadays the referer header are either shortened or voided by the browser. You reintroducing the string by a side-channel could be

For the privacy of the user, nowadays the referer header are either shortened or voided by the browser. You reintroducing the string by a side-channel could be seen by users as a backstab, even if you see it as "etiquette".

extraduder_ire 5mo ago
At the very least, people seem to have settled on one or two args to use for this. e.g. "utm_source". I tried entering ?utm_source=foo on Chris's site when it was posted the other day, and was surprised it didn't trigger the page. Pretty sure one or more of my firefox extensions remove that specific one from URLs before making the request. Facebook combining tracking and IDs into an opaque UUID in URLs so they can't be removed is a level of user hostility beyond this.
- chrismorgan 5mo ago
  Firefox’s Enhanced Tracking Protection removes a few such parameters. Now I have the stupid contrary idea, require a specific query string parameter to be present…
  - chrismorgan 5mo ago
    I must correct myself: utm_* is not part of Firefox’s query stripping, which only removes about 23 parameters: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/query-stripping/records https://firefox.settings.services.mozilla.com/v1/buckets/mai... For me, it comes from uBlock Origin’s AdGuard/uBO – URL Tracking Protection list, which removes almost three hundred parameters unconditionally and a lot more conditionally: https://github.com/uBlockOrigin/uAssets/blob/master/filters/privacy-removeparam.txt https://github.com/uBlockOrigin/uAssets/blob/master/filters/... (A few of the parameters in that list are a little alarming in a you-could-easily-name-a-legitimate-parameter-this sort of way, like user_email_address, maf and taid.)