6 ms·

Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'

by abcd_f 14y ago

Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'm on the page that pulls down something from Google Fonts, I see no reason why I should be sharing with Google the URL of the page I'm visiting.

Achshar 14y ago
But a request is still a request. It might not make sense to include referer data in the case you mentioned but that does not mean every cros request will fit that description.
- abcd_f 14y ago
  Give me an example where sending a Referer is essential to providing me as a user with a better experience. There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as simple as this.
  - deleted 14y ago
    [deleted]
  - Retric 14y ago
    How about newspapers that show articles when a user comes from Google but not otherwise?
    - epmatsw 14y ago
      How is that a better experience? This is a legitimate question, I don't think I understand what you're referring to.
      - anonymoushn 14y ago
        I think he means that showing you an article is a better experience than not showing you an article.
      - Achshar 14y ago
        Maybe he means cases where newspaper sites let users skip paywall if they are coming from google x times a month.
  - cbr 14y ago
    Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. This is short sighted. Sites can respond to referrers by improving themselves and better adapting to what users are looking for.
    - huhtenberg 14y ago
      Sure, in theory.
  - icebraining 14y ago
    Anti-hot-linking may be dumb to protect the content, but it's very useful to protect others from abusing sites as if they were free image hosters. I run a small site, and we would occasionally get hotlinked by random people searching for images on Google, which would kill our bandwidth caps. If it weren't for referer filters, we'd have to hide any image for unregistered users. That said, keep just first-party referers would be fine - we'd just block any image request without referer.
  - lftl 14y ago
    I don't think the referer info is ever really essential but here are some possibilities: 1) If you came from a social media site, maybe I'd highlight that particular social sharing option in a share bar, or hide others. 2) In an e-commerce store, maybe Google sent you to some page on my site that isn't really the best for your search term (product discontinued, other better matching product), I can give you a link to that other page. Google isn't necessarily magical in its ability to pick the best page on a site for a specific term. Maybe if you come from a competitor I can highlight some content that compares my product to the competitor's. 3) I've never derived a ton of benefit from it, but some sites will highlight your search term for you on a page. It could possibly also automatically scroll you to a relevant section if it's a long page and what you searched for is an exact match for some subsection. In general it can be a valuable data point sites can use to improve the end-user experience. That being said, I can't think of anything where the value really outweighs the potential for abuse, but I think saying that it has no value to the user is short-sighted.
  - bsimpson 14y ago
    Isn't the Referrer header what Google Analytics et. al. use to tell you how people are finding pages on your site? Seems like that could be quite useful for a webmaster to learn more about his audience, tailoring his content to better fit the traffic coming from those sources and identifying other sites that might be abusive (e.g. scraping his content).
  - potch 14y ago
    The ability to highlight search terms in a page. You may disagree that is a better experience for you, but you may not make blanket statements that "there are no such cases, period".
socillion 14y ago
You can use an addon like Smart Referer[1] (removes cross domain referer headers) but it does unpredictably break sites that depend on it. Considering it requires whitelisting to avoid weird and hard to diagnose issues, it seems unlikely to be added to Firefox. 1. https://addons.mozilla.org/en-US/firefox/addon/smart-referer/ https://addons.mozilla.org/en-US/firefox/addon/smart-referer...
briansmith 14y ago
First, there are already multiple Firefox extensions that will let you totally control the Referer header. (In general, if there's something that you want to change about Firefox, you should search https://addons.mozilla.org https://addons.mozilla.org to find a solution, because somebody's probably already created an extension that does what you want.) I think one such extension is called "RefControl." I also brought up the issue on Mozilla's dev.privacy mailing list [1] recently. See: https://groups.google.com/d/msg/mozilla.dev.privacy/wmPzPCdzIU8/Vrugn8XquL4J https://groups.google.com/d/msg/mozilla.dev.privacy/wmPzPCdz... In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites. My proposal is to strip the Referer header down to just the origin + '/', e.g. http://example.org/ http://example.org/ instead of http://example.org/foo?search=whatever+you+searched+for http://example.org/foo?search=whatever+you+searched+for. I think it will be difficult for us to go further than that in the default configuration any time soon (and, as you can see in that thread, there's even some pushback to my extremely reasonable proposal). Also, I know there is active work happening to bring extra control over the Referer header to Firefox's built-in prefs. This seems to be a little bit in conflict with our "Checkboxes that kill" project so I'm not sure how it will turn out. [1] https://lists.mozilla.org/listinfo/dev-privacy https://lists.mozilla.org/listinfo/dev-privacy
- Silhouette 14y ago
  FWIW, I just followed your advice, searching Firefox Addons for "Referer". The results were not helpful at all for the goal abcd_f mentioned of blocking cross-site referrers. [Edit: Sorry, it looks like I mistyped "Referer". There is at least one promising addon on the first page.] Also FWIW, I agree that this is indeed becoming a significant privacy issue. I too don't see why Google or Typekit or some widely used CDN should be gifted a convenient history of my web browsing just because they host popular JavaScript libraries or web fonts. I'm intrigued by this comment: In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites. Is this because some of the third party resources are only authorised for use by certain sites and rely on Referer to establish whether a given request qualifies? Given that there is no security or verification for Referer headers, that seems like a rather broken model to start with. I can't help thinking that if one of the big browsers forced the issue then those services would have to reconsider and do things a smarter way. That seems likely to inherently reduce the amount of unnecessary information being passed across to those third party services in the first place.
copypasteweb 14y ago
RefControl is a nice addon for that, with ability to set default behaviour and override it for specific domains. https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ https://addons.mozilla.org/en-US/firefox/addon/refcontrol/
tquai 14y ago
Any ETA for allowing to block Referer header from being included in cross-origin requests? This feature has been supported in Firefox for a long time, but you have to set it in about:config via the "network.http.sendRefererHeader" integer. 2 = always send 1 = send only to same FQDN (what you seem to want) 0 = never send IMO this is one of the best bang-for-your-buck privacy configurations. I would love it if Mozilla changed the default from 2 to 1, and at the least, it SHOULD be an option under the Preferences -> Privacy tab.

by abcd_f 14y ago

Achshar 14y ago

But a request is still a request. It might not make sense to include referer data in the case you mentioned but that does not mean every cros request will fit that description.

abcd_f 14y ago
Give me an example where sending a Referer is essential to providing me as a user with a better experience. There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as simple as this.
- deleted 14y ago
  [deleted]
- Retric 14y ago
  How about newspapers that show articles when a user comes from Google but not otherwise?
  - epmatsw 14y ago
    How is that a better experience? This is a legitimate question, I don't think I understand what you're referring to.
    - anonymoushn 14y ago
      I think he means that showing you an article is a better experience than not showing you an article.
    - Achshar 14y ago
      Maybe he means cases where newspaper sites let users skip paywall if they are coming from google x times a month.
- cbr 14y ago
  Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. This is short sighted. Sites can respond to referrers by improving themselves and better adapting to what users are looking for.
  - huhtenberg 14y ago
    Sure, in theory.
- icebraining 14y ago
  Anti-hot-linking may be dumb to protect the content, but it's very useful to protect others from abusing sites as if they were free image hosters. I run a small site, and we would occasionally get hotlinked by random people searching for images on Google, which would kill our bandwidth caps. If it weren't for referer filters, we'd have to hide any image for unregistered users. That said, keep just first-party referers would be fine - we'd just block any image request without referer.
- lftl 14y ago
  I don't think the referer info is ever really essential but here are some possibilities: 1) If you came from a social media site, maybe I'd highlight that particular social sharing option in a share bar, or hide others. 2) In an e-commerce store, maybe Google sent you to some page on my site that isn't really the best for your search term (product discontinued, other better matching product), I can give you a link to that other page. Google isn't necessarily magical in its ability to pick the best page on a site for a specific term. Maybe if you come from a competitor I can highlight some content that compares my product to the competitor's. 3) I've never derived a ton of benefit from it, but some sites will highlight your search term for you on a page. It could possibly also automatically scroll you to a relevant section if it's a long page and what you searched for is an exact match for some subsection. In general it can be a valuable data point sites can use to improve the end-user experience. That being said, I can't think of anything where the value really outweighs the potential for abuse, but I think saying that it has no value to the user is short-sighted.
- bsimpson 14y ago
  Isn't the Referrer header what Google Analytics et. al. use to tell you how people are finding pages on your site? Seems like that could be quite useful for a webmaster to learn more about his audience, tailoring his content to better fit the traffic coming from those sources and identifying other sites that might be abusive (e.g. scraping his content).
- potch 14y ago
  The ability to highlight search terms in a page. You may disagree that is a better experience for you, but you may not make blanket statements that "there are no such cases, period".

socillion 14y ago

You can use an addon like Smart Referer[1] (removes cross domain referer headers) but it does unpredictably break sites that depend on it. Considering it requires whitelisting to avoid weird and hard to diagnose issues, it seems unlikely to be added to Firefox. 1. https://addons.mozilla.org/en-US/firefox/addon/smart-referer/ https://addons.mozilla.org/en-US/firefox/addon/smart-referer...

briansmith 14y ago

First, there are already multiple Firefox extensions that will let you totally control the Referer header. (In general, if there's something that you want to change about Firefox, you should search https://addons.mozilla.org https://addons.mozilla.org to find a solution, because somebody's probably already created an extension that does what you want.) I think one such extension is called "RefControl." I also brought up the issue on Mozilla's dev.privacy mailing list [1] recently. See: https://groups.google.com/d/msg/mozilla.dev.privacy/wmPzPCdzIU8/Vrugn8XquL4J https://groups.google.com/d/msg/mozilla.dev.privacy/wmPzPCdz... In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites. My proposal is to strip the Referer header down to just the origin + '/', e.g. http://example.org/ http://example.org/ instead of http://example.org/foo?search=whatever+you+searched+for http://example.org/foo?search=whatever+you+searched+for. I think it will be difficult for us to go further than that in the default configuration any time soon (and, as you can see in that thread, there's even some pushback to my extremely reasonable proposal). Also, I know there is active work happening to bring extra control over the Referer header to Firefox's built-in prefs. This seems to be a little bit in conflict with our "Checkboxes that kill" project so I'm not sure how it will turn out. [1] https://lists.mozilla.org/listinfo/dev-privacy https://lists.mozilla.org/listinfo/dev-privacy

Silhouette 14y ago
FWIW, I just followed your advice, searching Firefox Addons for "Referer". The results were not helpful at all for the goal abcd_f mentioned of blocking cross-site referrers. [Edit: Sorry, it looks like I mistyped "Referer". There is at least one promising addon on the first page.] Also FWIW, I agree that this is indeed becoming a significant privacy issue. I too don't see why Google or Typekit or some widely used CDN should be gifted a convenient history of my web browsing just because they host popular JavaScript libraries or web fonts. I'm intrigued by this comment: In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites. Is this because some of the third party resources are only authorised for use by certain sites and rely on Referer to establish whether a given request qualifies? Given that there is no security or verification for Referer headers, that seems like a rather broken model to start with. I can't help thinking that if one of the big browsers forced the issue then those services would have to reconsider and do things a smarter way. That seems likely to inherently reduce the amount of unnecessary information being passed across to those third party services in the first place.

copypasteweb 14y ago

RefControl is a nice addon for that, with ability to set default behaviour and override it for specific domains. https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ https://addons.mozilla.org/en-US/firefox/addon/refcontrol/

tquai 14y ago

Any ETA for allowing to block Referer header from being included in cross-origin requests? This feature has been supported in Firefox for a long time, but you have to set it in about:config via the "network.http.sendRefererHeader" integer. 2 = always send 1 = send only to same FQDN (what you seem to want) 0 = never send IMO this is one of the best bang-for-your-buck privacy configurations. I would love it if Mozilla changed the default from 2 to 1, and at the least, it SHOULD be an option under the Preferences -> Privacy tab.