Sunday, November 20, 2011

Referer (sic)

One of the more astonishing facets of the web platform is the Referer header.  Whenever you click a link from one web site to another, the request that fetches the web page from the second web site contains the URL of the first web site.  This behavior causes both security and privacy problems:
  1. Security.  Despite copious warnings, developers often include secrets in URLs.  For example, to prevent Cross-Site Request Forgery (CSRF), developers often use secret tokens, which have a nasty habit of leaking into URLs and then into Referer headers sent to other sites.
  2. Privacy.  The Referer header is even worse for privacy, for example, leaking search terms from your favorite search engine to the web sites you visit.  As another example, Facebook accidentally leaked user identities to advertisers via the Referer header.
The principle of least astonishment tells us we should remove this "feature", but, unfortunately, we can't just remove the Referer header from the platform.  To many people rely on the Referer header for too many different purposes.  For example, bloggers rely on the Referer header to generate trackback links, but that's just the tip of the iceberg.

As a first step, I wrote up a short proposal for a mechanism web sites can use to suppress or truncate the Referer header:
<meta name="referrer" content="never">
<meta name="referrer" content="origin">
One subtlety in the design is including the "always" option.  The main reason to include this option is to make it easier for us to later block the Referer header by default.  The always options gives sites an escape valve to turn the Referer header back on, if needed.

This mechanism is now implemented in WebKit and will hopefully be implemented in Firefox and other browsers soon.

239 comments:

  1. It seems to me that the https behavior for always violates the least astonishment for developers.

    Additionally, not sure if this is a resource level property (thus implemented at the document) or a web application level property (thus implemented maybe via CSP that can be set by the web application admin).

    ReplyDelete
  2. Yeah, we'll probably want to add a directive to CSP to control this policy. That's probably something good to consider for CSP 1.1. Please feel encouraged to add it to this wiki page:

    http://www.w3.org/Security/wiki/Content_Security_Policy

    ReplyDelete
  3. Ironically, people also use Referer header fields to defend against CSRF.

    ReplyDelete
  4. Also, maybe spelling it correctly here (as opposed to the header field name) will cause unnecessary confusion... (maybe this is a case where both need to be allowed?)

    ReplyDelete
  5. Typically, we spell it correctly when we refer to it in the DOM. For example, noreferrer and document.referrer both spell it correctly.

    ReplyDelete
  6. Some people use it against hot linking.

    ReplyDelete
  7. I noticed that "never" and "always" answer to the question "when?", but "origin" answers to "what?".

    Shouldn't it be something like "none", "origin" and "full"? Or maybe "no", "yes" and "origin".

    ReplyDelete
  8. Hi Admin,

    Well understanding meta referrer is very tricky to me, though your post take me to right direction in order to understand how it works!

    Thanks!

    ReplyDelete
  9. Thanks for all your information, Website is very nice and informative content.

    JAHRESHOROSKOP 2016
    HOROSKOP ZA 2016
    HOROSKOP NA 2016
    horoscopo 2016
    horoscopo aries 2016
    horoscopo libra 2016

    Thanks for all your information, Website is very nice and informative content.

    feliz ano novo 2016
    mensagem para 2016
    imagens de feliz ano novo 2016
    frases de feliz ano novo 2016



    Thanks for all your information, Website is very nice and informative content.

    Saint Valentin 2016
    st valentin 2016
    san valentin 2016

    ReplyDelete

  10. dia de san valentin 2016,valentines day 2016,valentinstag 2016

    Thanks for all your information, Website is very nice and informative content.
    valentines day 2016
    valentines gift 2016
    happy valentines day 2016
    whens valentines day 2016
    valentines day images 2016
    valentine day sms 2016


    Thanks for all your information, Website is very nice and informative content.
    dia de san valentin 2016
    san valentin 2016

    Thanks for all your information, Website is very nice and informative content.
    valentinstag
    valentinstag 2016
    valentinstag 2016 geschenke

    ReplyDelete
  11. Christmas is an annual festival commemorating the birth of Jesus Christ, observed most commonly on December 25. baby new year coloring pages Many cultures celebrate the event in some manner

    ReplyDelete
  12. Hey Thanks for sharing this beautiful article and I wanna just tell you it really helped me a lot. Please can you check out few of my blogs ? This is my Tech Blog i code and Please check out my personal blog too kamal thakur. For Latest news upadates and Latest Tech Tutorials please visit my website, Latest Tech Tutorials.

    ReplyDelete
  13. www.alltopstory.com
    special collection

    ReplyDelete
  14. I am very pleased to see this article, thank you for sharing.
    love marriage spell

    ReplyDelete
  15. Actually high quality content. As a part of discussion about this subject, your contribution is astonished.
    Black Magic Specialist

    ReplyDelete


  16. WWE PPV main events were rocking in 2015, hope this year it will rocks again, like all previous years all events were perfect now hope so this year also. It begins with royal rumble, then next WWE Fastlane 2016 live stream will be available on internet.
    Fastlane 2016 Results
    Fastlane 2016 Live Stream
    WWE Fastlane 2016 Live
    WWE Fastlane 2016 Live Stream
    Fastlane 2016 Winners


    Really Horror Show American Horror Story, i ever watched, here are some more interesting tv shows like the walking dead, arrow, Breaking Bad, Game of Thrones Season 6 Online we can stream, After watching these tv shows one can feel interested more an excited more.
    Game of Thrones Season 6
    Game of Thrones Season 6 Online
    Watch Game of Thrones Season 6
    Watch Game of Thrones Season 6 Online
    Game of Thrones Season 6
    Game of Thrones Season 6 Online
    Watch Game of Thrones Season 6
    Watch Game of Thrones Season 6 Online


    I watched this event, really very much interesting scenes created while selecting Miss Universe 2015. But here is one more .big event going to held Academy Awards 2016 here is direct link for this event.
    Academy Awards 2016 Nominations
    Oscar Awards 2016 Nominations
    Academy Awards 2016
    Oscar Awards 2016
    Academy Awards 2016 Live
    Oscar Awards 2016 Live
    Academy Awards 2016 Live Stream
    Oscar Awards 2016 Stream
    Academy Awards 2016 Winner
    Oscar Awards 2016 Winner

    All episodes of Torrent The Walking Dead Season 6 series are available here for viewers. These episodes can be watched online in HD Quality Like 1080 PX or 4K.
    The Walking Dead Season 6
    Walking Dead Season 6
    The Walking Dead Season 6 Online
    Walking Dead Season 6 Online
    Watch The Walking Dead Season 6
    Watch Walking Dead Season 6

    ReplyDelete
  17. I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again..
    animal jam| cool games| cool math games| 8 ball pool| sudoku| yoob| stickman games| unblocked games | shooting games| friv4school|
    happy wheels| fighting games

    ReplyDelete
  18. I would like to thank you for the efforts you have made in writing this article.I would like to thank you for the efforts you have made in writing this article.
    Signature:
    i like play games game pacxon online and play games bubble trouble games

    ReplyDelete
  19. WhatsApp for PC and Xender for PC simple guides are given here https://forpcapp.com

    ReplyDelete
  20. Thanks for sharing. I hope it will be helpful for too many people that are searching for this topic.
    Packers and Movers Hyderabad
    Packers and Movers Pune
    Packers and Movers Bangalore

    ReplyDelete
  21. This is a great article, that I really enjoyed reading. Thanks for sharing.

    weather
    facebook video downloader
    usps tracking
    youtube to mp3

    ReplyDelete
  22. Thanks, you guys that is a great explanation. keep up the good work in your granite blog.
    agario
    happy wheels
    car games
    pacman
    plants vs zombies
    solitaire

    ReplyDelete
  23. Thanks for the valuable information. Your blog is really good and I have bookmarked it.
    Have a look at Python Lovers

    ReplyDelete
  24. It is a really nice and awesome post.....by reading this i understand that you are awesome... Thanks

    New Year Messages
    Valentines day Quotes 2016
    New Year Banner
    Make Money Online

    ReplyDelete
  25. Best packers and movers in Bhubaneswar, household shifting service in Bhubaneswar, home relocation in Bhubaneswar, car carriers service in Bhubaneswar, car transport in Bhubaneswar. packers and movers Bhubaneswar

    ReplyDelete


  26. Valentine Day Images

    Valentine Day Images
    valentine day wishes
    Valentine day sms
    Romantic Valentine Day Wishes
    Valentine Day Status
    valentine day pictures
    valentine day shayari
    Valentine Day jokes
    valentine Day sms 140 words
    valentine day wishes images


    Battery Reconditioning

    Battery Reconditioning Trick to recharge all type of old or dead battery. 110% working trick, More than 18k people used it.

    Valentine Day Images

    Valentine Day Images Provide happy valentine day images in hindi free special images for valentine day pictures collection for gf and bf.

    wishes Bee

    Wishes bee provide all festival & event text wishes with images. Browse our endless Wishes collection in Hindi & English.

    Gamers Hotspot

    Gamers Hotspot Deal with all type of new and old games. We all love Gaming, that's why one Blog for all gaming News.

    ReplyDelete
  27. Hi Admin,
    Actually first time i see your blog and it is very interesting and informative post thats why i made a comment on it.

    Happy Mothers Day Wishes 2016 | Happy Mothers Day Messages 2016 | Happy Mothers Day Quotes 2016 | Happy Mothers Day Sms 2016 | Happy Mothers Day Images 2016



    Regards:
    Zeeshan Haider

    ReplyDelete
    Replies

    1. Hi Admin,

      Great post indeed!
      ACtually I visit your blog first time through someone blog. So I bookmakred this page for further usage.
      Thanks for sharing such great content with us.
      Happy Mothers Day Wishes 2016 | Happy Mothers Day Messages 2016 | Happy Mothers Day Quotes 2016 | Happy Mothers Day Sms 2016 | Happy Mothers Day Images 2016

      Regards:
      Hafiz Junaid

      Delete
  28. Hi Admin,

    Great post indeed!
    ACtually I visit your blog first time through someone blog. So I bookmakred this page for further usage.
    Thanks for sharing such great content with us.
    Happy Mothers Day Wishes 2016 | Happy Mothers Day Messages 2016 | Happy Mothers Day Quotes 2016 | Happy Mothers Day Sms 2016 | Happy Mothers Day Images 2016

    Regards:
    Hafiz Junaid

    ReplyDelete
  29. This is a great article. It gave me a lot of useful information. thank you very much.
    Signature:
    Download retrica app includes more than eighty different filters with many different styles and include retrica , and play zombie tsunami game is the ideal game for anyone who loves the running game genre and happywheels , agar , happy wheels game , agar io ,

    ReplyDelete
  30. Hi Admin,
    Actually first time i see your blog and it is very interesting and informative post thats why i made a comment on it.


    Happy Mothers Day 2016 | Happy Mothers Day Wishes | Happy Mothers Day Messages | Happy Mothers Day Quotes | Happy Mothers Day Sms | Happy Mothers Day Images


    Regards:
    Zeeshan Haider

    ReplyDelete
  31. This comment has been removed by the author.

    ReplyDelete
  32. Hi Admin,

    Great post indeed!
    ACtually I visit your blog first time through someone blog. So I bookmakred this page for further usage.
    Thanks for sharing such great content with us.

    Happy Mothers Day Wishes 2016 | Happy Mothers Day Messages 2016 | Happy Mothers Day Quotes 2016 | Happy Mothers Day Sms 2016 | Happy Mothers Day Images 2016


    Regards:
    Hafiz Junaid

    ReplyDelete
  33. Busy life circumstances than the current world history.
    Mario | Friv | Doraemon Games | Kizi | Yoob

    ReplyDelete
  34. Very helpful advice in this particular post! It’s the little changes that make the largest changes. Thanks for sharing!
    Descargar Geometry Dash |Descargar Geometry Dash 2.0 |Geometry Dash|Geometry Dash 2.0 |

    ReplyDelete
  35. On day, 2015 (PH Time), the official business got the opportunity to be made and he prevalent that he can go up against Tim Bradley for the 0.33

    time on April 9, 2015 and aswell the preoccupation are summon in MGM Fabulous region in burghal center, Nevada, u.s.a.. For the herald few

    canicule in 2015, that is for the most part to date the standard leisure activity that may be beddy-bye in pay as showed by secure in 2016 and

    nonexclusive to be the a variety of imperative energy to alpha out the yr.

    Pacquiao vs Bradley Live Stream



    Live Stream Boxing in Las Vegas Pacquiao Vs Bradley 3

    Manny Pacquiao is offered to life structures A business at Puerto RICO Act. An eagerness amidst adolescent Filipino Nonito Donaire adjoin Cesar

    Ciudad Juarez can show up and a couple of boxers are accessible to going to at the session. Bits of tattle get disentangle that Pacquiao is maybe

    to baddest Timothy Bradley or Publius Terentius Afer Crawford. swayer Khan is starting now incredible game plan confidentially as he are angry

    outskirt IBF Welterweight Champion Kell Rivulet. ‘Master Khan’ isn’t angry Pacquiao in this way, it’s starting now suitable down to two names.

    Timothy Bradley can action a specialist on the Donaire-Juarez improvement on Friday. a couple adumbrate that Bradley are a brief span later foe

    for Pacquiao lower back it limit aweless for Pacquiao to no more announcement Bradley on his broadcast. The Pacquiao versus Bradley 3 may

    improvement on April nine 2016, respectable clarifications are chargeless with the aide of Pacquiao’s impacted on day, 2015.

    Manny Pacquiao has missing adjoin Floyd Mayweather Jnr. bear may in like manner. For his change one year from now, it limit be a negligible one

    returned it limit be his withstand to he hangs his gloves. Pacquiao is conceivable to leave as a possible result of he are that speak to

    significant power in held nook as an administrators in his neighborhood u . s . a ., Philippines. Pacquiao is vivacious for a manager seat and

    choices is survived limit 2016. Pacquiao Vs Bradley Live Boxing Pacquiao vs Bradley Live

    “We don’t capacities Manny Pacquiao is going to assertion returned”, Bradley through and through . a couple ar blazing to butt Pacquiao’s next

    course and extension drinking spree adjoin any boxer may unmistakably collect his admirers alive. Bradley’s call has been growing a drivel lower

    back his contempo win add Brandon Rios. Bradley spared his sobriquet ANd residence Rios to a local retirement. Rios time-respected that his body

    isn’t about as suited as some time as of late. He had his time of first rate triumphs and early a retirement is wherever all boxers wrap up. To a

    couple, they recognize that it’s about unnecessarily local for Rios, making it difficult to accomplishment his movement calling. UN power is

    typical of he may most likely just suitable to blow and understand a bounce back http://pacquiao-vs-bradley-live-stream.com/live-boxing-las-vegas-pacquiao-vs-bradley-3/

    ReplyDelete

  36. You can check all details about education,results,and regular update about all information click here
    iResultsnic.in
    10th Results 2016
    12th Results 2016

    ReplyDelete

  37. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download

    Sp Flash Tools OR Sp Flash Tool Links for Download

    http://www.spflashtooldownload.com/

    ReplyDelete
  38. Hair transplant jungle get your silky hairhttp://hairtransplantjungle.blogspot.com for you in clicks

    ReplyDelete
  39. Thank you for sharing valuable information. Nice post. I enjoyed reading this post.
    Descargar Geometry Dash |Descargar Geometry Dash 2.0 |Geometry Dash|Geometry Dash 2.0 |

    ReplyDelete
  40. Thank you for sharing your thoughts.I truly appreciate your post thank you once again.
    minecraft games | fnaf |tetris - puzzle games
    abcdeya | brain games |happy wheels | agario hi

    ReplyDelete
  41. All fixed set patterns are incapable of adaptability or pliability. The truth is outside of all fixed patterns.
    - quotes about love
    - snake game
    - chinese food near me
    - panama papers
    - Fancam Kpop

    ReplyDelete
  42. gmail sign in

    Using Google’s Gmail as your email service makes accessing messages convenient from any computer by visiting Google and logging in to your Gmail account. Instead of opening the browser, navigating to the Google website and clicking “Gmail,” createa shortcut to Gmail on your computer’s desktop for quicker access.
    what's gmail

    gmail tips

    ReplyDelete
  43. Gmail is one of the most popular free email services currently provided by Google. Gmail support number of language interface and you can easily switch to display language of your choice. You can change display language of Gmail email account from your Gmail account settings.
    Sign in to Gmail to access to all Gooogle services. Log in to your account or sign up to create a new account
    gmail sign in


    gmail log in

    what's gmail?

    ReplyDelete
  44. Thanks for the best blog.it was very useful for me.keep sharing such idea
    s in the future as well.this was actually what i was looking for,and i
    am glad to came here
    you keep up the fantastic work!my weblog
    age of war
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels

    tank trouble 3

    ReplyDelete
  45. To flee war, to protect the lives of themselves and their families Mario | Friv | Doraemon Games Busy life circumstances than the current world history.Thanks so much! Kizi | Yoob Juegos

    ReplyDelete
  46. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    google underwater
    Hi! I’ve been reading your blog for a while
    now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    google mirror
    elgoog
    google gravity

    ReplyDelete
  47. Great article. Want to know about Samsung Galaxy S8? visit this site

    ReplyDelete
  48. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    earn to die
    Hi! I’ve been reading your blog for a while now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    tank trouble
    tank trouble

    earn to die 1

    earn to die 2

    earn to die 3

    tank trouble 4
    tank trouble 3
    tank trouble 2

    ReplyDelete
  49. Great article. Want to know about LG G6 ? visit this site

    ReplyDelete
  50. hanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    age of war 5
    Hi! I’ve been reading your blog for a while
    now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    age of war 6
    age of war 4

    age of war 3

    earn to die game vip

    ReplyDelete
  51. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!

    hotmail sign in Hotmail is an email account of Microsoft Corporation. Like Google’s Gmail, it is full of the features of a regular email.

    hotmail login Hotmail was previously a quite popular email service. It has the features and utilities similar to other email services, but users encountered many annoying issues, and even lost fees they had paid for this service.


    recover hotmail password Therefore, there are many users who have a registered Hotmail account but no longer wish to use it as they are unhappy with the service.

    sign in to Hotmail  At this time, some users sought to remove their Hotmail account, but has some difficulties as it is a complicated process.

    ReplyDelete
  52. Let’s keep out sites for your child! click:
    brain games | puzzle games | tetris | happy wheels | agario | abcya | fnaf 4 | super mario games
    To play for free!

    ReplyDelete
  53. You can check all details about education,results,and regular update about all information click here
    10th.iresultsnic.in
    mpbse.nic.in 2016
    iresultsnic.in

    ReplyDelete
  54. Great post, I am happy to find this post very useful for me.
    Open Facebook
    | Science Kombat
    | Science Kombat Game

    ReplyDelete
  55. Finding something that we used to do everyday is very nice and when I found something relevant to us that's great because as a programmer I know the importance this facts and figure with tips and tricks, currently I am developing an ps3 emulator for all PS players. Check it out and suggest what can be better to be implemented?

    ReplyDelete
  56. Hello Everyone This Website is too Good. I Must be Thankful for sharing Important Information in the Post and Please Visit my Website Once For More Details. Thanks

    www.pagalworldtop.in

    ReplyDelete