Sunday, November 20, 2011

Referer (sic)

One of the more astonishing facets of the web platform is the Referer header.  Whenever you click a link from one web site to another, the request that fetches the web page from the second web site contains the URL of the first web site.  This behavior causes both security and privacy problems:
  1. Security.  Despite copious warnings, developers often include secrets in URLs.  For example, to prevent Cross-Site Request Forgery (CSRF), developers often use secret tokens, which have a nasty habit of leaking into URLs and then into Referer headers sent to other sites.
  2. Privacy.  The Referer header is even worse for privacy, for example, leaking search terms from your favorite search engine to the web sites you visit.  As another example, Facebook accidentally leaked user identities to advertisers via the Referer header.
The principle of least astonishment tells us we should remove this "feature", but, unfortunately, we can't just remove the Referer header from the platform.  To many people rely on the Referer header for too many different purposes.  For example, bloggers rely on the Referer header to generate trackback links, but that's just the tip of the iceberg.

As a first step, I wrote up a short proposal for a mechanism web sites can use to suppress or truncate the Referer header:
<meta name="referrer" content="never">
<meta name="referrer" content="origin">
One subtlety in the design is including the "always" option.  The main reason to include this option is to make it easier for us to later block the Referer header by default.  The always options gives sites an escape valve to turn the Referer header back on, if needed.

This mechanism is now implemented in WebKit and will hopefully be implemented in Firefox and other browsers soon.

89 comments:

  1. It seems to me that the https behavior for always violates the least astonishment for developers.

    Additionally, not sure if this is a resource level property (thus implemented at the document) or a web application level property (thus implemented maybe via CSP that can be set by the web application admin).

    ReplyDelete
  2. Yeah, we'll probably want to add a directive to CSP to control this policy. That's probably something good to consider for CSP 1.1. Please feel encouraged to add it to this wiki page:

    http://www.w3.org/Security/wiki/Content_Security_Policy

    ReplyDelete
  3. Ironically, people also use Referer header fields to defend against CSRF.

    ReplyDelete
  4. Also, maybe spelling it correctly here (as opposed to the header field name) will cause unnecessary confusion... (maybe this is a case where both need to be allowed?)

    ReplyDelete
  5. Typically, we spell it correctly when we refer to it in the DOM. For example, noreferrer and document.referrer both spell it correctly.

    ReplyDelete
  6. Some people use it against hot linking.

    ReplyDelete
  7. I noticed that "never" and "always" answer to the question "when?", but "origin" answers to "what?".

    Shouldn't it be something like "none", "origin" and "full"? Or maybe "no", "yes" and "origin".

    ReplyDelete
  8. Hi Admin,

    Well understanding meta referrer is very tricky to me, though your post take me to right direction in order to understand how it works!

    Thanks!

    ReplyDelete
  9. Thanks for all your information, Website is very nice and informative content.

    JAHRESHOROSKOP 2016
    HOROSKOP ZA 2016
    HOROSKOP NA 2016
    horoscopo 2016
    horoscopo aries 2016
    horoscopo libra 2016

    Thanks for all your information, Website is very nice and informative content.

    feliz ano novo 2016
    mensagem para 2016
    imagens de feliz ano novo 2016
    frases de feliz ano novo 2016



    Thanks for all your information, Website is very nice and informative content.

    Saint Valentin 2016
    st valentin 2016
    san valentin 2016

    ReplyDelete

  10. dia de san valentin 2016,valentines day 2016,valentinstag 2016

    Thanks for all your information, Website is very nice and informative content.
    valentines day 2016
    valentines gift 2016
    happy valentines day 2016
    whens valentines day 2016
    valentines day images 2016
    valentine day sms 2016


    Thanks for all your information, Website is very nice and informative content.
    dia de san valentin 2016
    san valentin 2016

    Thanks for all your information, Website is very nice and informative content.
    valentinstag
    valentinstag 2016
    valentinstag 2016 geschenke

    ReplyDelete
  11. Christmas is an annual festival commemorating the birth of Jesus Christ, observed most commonly on December 25. baby new year coloring pages Many cultures celebrate the event in some manner

    ReplyDelete
  12. Hey Thanks for sharing this beautiful article and I wanna just tell you it really helped me a lot. Please can you check out few of my blogs ? This is my Tech Blog i code and Please check out my personal blog too kamal thakur. For Latest news upadates and Latest Tech Tutorials please visit my website, Latest Tech Tutorials.

    ReplyDelete
  13. www.alltopstory.com
    special collection

    ReplyDelete
  14. I am very pleased to see this article, thank you for sharing.
    love marriage spell

    ReplyDelete
  15. Actually high quality content. As a part of discussion about this subject, your contribution is astonished.
    Black Magic Specialist

    ReplyDelete


  16. WWE PPV main events were rocking in 2015, hope this year it will rocks again, like all previous years all events were perfect now hope so this year also. It begins with royal rumble, then next WWE Fastlane 2016 live stream will be available on internet.
    Fastlane 2016 Results
    Fastlane 2016 Live Stream
    WWE Fastlane 2016 Live
    WWE Fastlane 2016 Live Stream
    Fastlane 2016 Winners


    Really Horror Show American Horror Story, i ever watched, here are some more interesting tv shows like the walking dead, arrow, Breaking Bad, Game of Thrones Season 6 Online we can stream, After watching these tv shows one can feel interested more an excited more.
    Game of Thrones Season 6
    Game of Thrones Season 6 Online
    Watch Game of Thrones Season 6
    Watch Game of Thrones Season 6 Online
    Game of Thrones Season 6
    Game of Thrones Season 6 Online
    Watch Game of Thrones Season 6
    Watch Game of Thrones Season 6 Online


    I watched this event, really very much interesting scenes created while selecting Miss Universe 2015. But here is one more .big event going to held Academy Awards 2016 here is direct link for this event.
    Academy Awards 2016 Nominations
    Oscar Awards 2016 Nominations
    Academy Awards 2016
    Oscar Awards 2016
    Academy Awards 2016 Live
    Oscar Awards 2016 Live
    Academy Awards 2016 Live Stream
    Oscar Awards 2016 Stream
    Academy Awards 2016 Winner
    Oscar Awards 2016 Winner

    All episodes of Torrent The Walking Dead Season 6 series are available here for viewers. These episodes can be watched online in HD Quality Like 1080 PX or 4K.
    The Walking Dead Season 6
    Walking Dead Season 6
    The Walking Dead Season 6 Online
    Walking Dead Season 6 Online
    Watch The Walking Dead Season 6
    Watch Walking Dead Season 6

    ReplyDelete
  17. I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again..
    animal jam| cool games| cool math games| 8 ball pool| sudoku| yoob| stickman games| unblocked games | shooting games| friv4school|
    happy wheels| fighting games

    ReplyDelete
  18. I would like to thank you for the efforts you have made in writing this article.I would like to thank you for the efforts you have made in writing this article.
    Signature:
    i like play games game pacxon online and play games bubble trouble games

    ReplyDelete
  19. WhatsApp for PC and Xender for PC simple guides are given here https://forpcapp.com

    ReplyDelete
  20. Thanks for sharing. I hope it will be helpful for too many people that are searching for this topic.
    Packers and Movers Hyderabad
    Packers and Movers Pune
    Packers and Movers Bangalore

    ReplyDelete
  21. This is a great article, that I really enjoyed reading. Thanks for sharing.

    weather
    facebook video downloader
    usps tracking
    youtube to mp3

    ReplyDelete
  22. Thanks, you guys that is a great explanation. keep up the good work in your granite blog.
    agario
    happy wheels
    car games
    pacman
    plants vs zombies
    solitaire

    ReplyDelete
  23. Thanks for the valuable information. Your blog is really good and I have bookmarked it.
    Have a look at Python Lovers

    ReplyDelete
  24. It is a really nice and awesome post.....by reading this i understand that you are awesome... Thanks

    New Year Messages
    Valentines day Quotes 2016
    New Year Banner
    Make Money Online

    ReplyDelete
  25. Best packers and movers in Bhubaneswar, household shifting service in Bhubaneswar, home relocation in Bhubaneswar, car carriers service in Bhubaneswar, car transport in Bhubaneswar. packers and movers Bhubaneswar

    ReplyDelete


  26. Valentine Day Images

    Valentine Day Images
    valentine day wishes
    Valentine day sms
    Romantic Valentine Day Wishes
    Valentine Day Status
    valentine day pictures
    valentine day shayari
    Valentine Day jokes
    valentine Day sms 140 words
    valentine day wishes images


    Battery Reconditioning

    Battery Reconditioning Trick to recharge all type of old or dead battery. 110% working trick, More than 18k people used it.

    Valentine Day Images

    Valentine Day Images Provide happy valentine day images in hindi free special images for valentine day pictures collection for gf and bf.

    wishes Bee

    Wishes bee provide all festival & event text wishes with images. Browse our endless Wishes collection in Hindi & English.

    Gamers Hotspot

    Gamers Hotspot Deal with all type of new and old games. We all love Gaming, that's why one Blog for all gaming News.

    ReplyDelete