4 ms·

Example.com is the third party. (Example.org and a human user being the first two parties.) I disagree. When you click a link on a page that you retrieved from

Example.com is the third party. (Example.org and a human user being the first two parties.) I disagree. When you click a link on a page that you retrieved from example.org, one that leads to example.com, there is no communication between you and example.org, nor between example.com and example.org. The communication that takes place is between you (party 1, the initiator of the conversation) and example.com (party 2, the target). The HTTP request mentions example.org, but being a third party, it does not participate in it directly. The only conversation in which example.org was a party was the one in which you requested the page that contained a link to example.com, which has already finished. In that light, it seems strange to me that under HTML5 (assuming I understand the article correctly), example.org is given a mechanism to dictate how much information you give to example.com. Should that not be your choice, as the sender of said information?

Smerity 13y ago
1) User's browser requests page from Site A 2) Page from Site A suggests what should be sent in the referrer via the meta referrer 3) User clicks on link from Site A to Site B 4) User's browser requests page from Site B (referrer is set by either user's overriding option or the meta referrer from Site A) So indeed, at no point does Site A speak to Site B directly. The meta referrer simply asks the user to either send or not send the referrer. If the meta referrer is not present or not supported, it falls back to default HTTP Referrer behaviour. As the user, you can override this behaviour and force the referrer to do whatever you'd like. This includes refusing to send it, always sending it, or spoofing it. Firefox for example allows you to set network.http.sendRefererHeader and there are various browser extensions for any popular browser that will allow for finer grained referrer control.

Smerity 13y ago

1) User's browser requests page from Site A 2) Page from Site A suggests what should be sent in the referrer via the meta referrer 3) User clicks on link from Site A to Site B 4) User's browser requests page from Site B (referrer is set by either user's overriding option or the meta referrer from Site A) So indeed, at no point does Site A speak to Site B directly. The meta referrer simply asks the user to either send or not send the referrer. If the meta referrer is not present or not supported, it falls back to default HTTP Referrer behaviour. As the user, you can override this behaviour and force the referrer to do whatever you'd like. This includes refusing to send it, always sending it, or spoofing it. Firefox for example allows you to set network.http.sendRefererHeader and there are various browser extensions for any popular browser that will allow for finer grained referrer control.