3 ms·
A simple "noreferrer" (or referer if you like) tag on elements or in pages would solve a lot of this. 3rd parties would obviously still get the request, but the
by MichaelGG 12y ago
A simple "noreferrer" (or referer if you like) tag on elements or in pages would solve a lot of this. 3rd parties would obviously still get the request, but they wouldn't know what page it comes from.
Interesting that "norel" got adopted so quickly for spam. So it shouldn't be hard to have a "noreferrer" tag added, right?
Yes, users can install addons to modify header behaviour, but site designers should be able to use third parties without disclosing things, too. Not just privacy, but security. Currently, apps need to implement a bouncer page to hide sensitive referrers.
- cromwellian 12y agoI like this proposal. Although as you say, it only cuts the direct link between the site and the resource.
- petercooper 12y agoSo it shouldn't be hard to have a "noreferrer" tag added, right? It's so not hard that it's actually already a part of HTML5 and supported by several browsers :-) http://www.w3.org/TR/html5/links.html#rel-noreferrer http://www.w3.org/TR/html5/links.html#rel-noreferrer
- MichaelGG 12y agoSeems like it isn't on link, image, or script elements though, which is the way most third party content gets loaded.