Sunday, November 20, 2011

Referer (sic)

One of the more astonishing facets of the web platform is the Referer header.  Whenever you click a link from one web site to another, the request that fetches the web page from the second web site contains the URL of the first web site.  This behavior causes both security and privacy problems:
  1. Security.  Despite copious warnings, developers often include secrets in URLs.  For example, to prevent Cross-Site Request Forgery (CSRF), developers often use secret tokens, which have a nasty habit of leaking into URLs and then into Referer headers sent to other sites.
  2. Privacy.  The Referer header is even worse for privacy, for example, leaking search terms from your favorite search engine to the web sites you visit.  As another example, Facebook accidentally leaked user identities to advertisers via the Referer header.
The principle of least astonishment tells us we should remove this "feature", but, unfortunately, we can't just remove the Referer header from the platform.  To many people rely on the Referer header for too many different purposes.  For example, bloggers rely on the Referer header to generate trackback links, but that's just the tip of the iceberg.

As a first step, I wrote up a short proposal for a mechanism web sites can use to suppress or truncate the Referer header:
<meta name="referrer" content="never">
<meta name="referrer" content="origin">
One subtlety in the design is including the "always" option.  The main reason to include this option is to make it easier for us to later block the Referer header by default.  The always options gives sites an escape valve to turn the Referer header back on, if needed.

This mechanism is now implemented in WebKit and will hopefully be implemented in Firefox and other browsers soon.

334 comments:

  1. It seems to me that the https behavior for always violates the least astonishment for developers.

    Additionally, not sure if this is a resource level property (thus implemented at the document) or a web application level property (thus implemented maybe via CSP that can be set by the web application admin).

    ReplyDelete
  2. Yeah, we'll probably want to add a directive to CSP to control this policy. That's probably something good to consider for CSP 1.1. Please feel encouraged to add it to this wiki page:

    http://www.w3.org/Security/wiki/Content_Security_Policy

    ReplyDelete
  3. Ironically, people also use Referer header fields to defend against CSRF.

    ReplyDelete
  4. Also, maybe spelling it correctly here (as opposed to the header field name) will cause unnecessary confusion... (maybe this is a case where both need to be allowed?)

    ReplyDelete
  5. Typically, we spell it correctly when we refer to it in the DOM. For example, noreferrer and document.referrer both spell it correctly.

    ReplyDelete
  6. Some people use it against hot linking.

    ReplyDelete
  7. I noticed that "never" and "always" answer to the question "when?", but "origin" answers to "what?".

    Shouldn't it be something like "none", "origin" and "full"? Or maybe "no", "yes" and "origin".

    ReplyDelete
  8. Hi Admin,

    Well understanding meta referrer is very tricky to me, though your post take me to right direction in order to understand how it works!

    Thanks!

    ReplyDelete
  9. Thanks for all your information, Website is very nice and informative content.

    JAHRESHOROSKOP 2016
    HOROSKOP ZA 2016
    HOROSKOP NA 2016
    horoscopo 2016
    horoscopo aries 2016
    horoscopo libra 2016

    Thanks for all your information, Website is very nice and informative content.

    feliz ano novo 2016
    mensagem para 2016
    imagens de feliz ano novo 2016
    frases de feliz ano novo 2016



    Thanks for all your information, Website is very nice and informative content.

    Saint Valentin 2016
    st valentin 2016
    san valentin 2016

    ReplyDelete
  10. Christmas is an annual festival commemorating the birth of Jesus Christ, observed most commonly on December 25. baby new year coloring pages Many cultures celebrate the event in some manner

    ReplyDelete
  11. Hey Thanks for sharing this beautiful article and I wanna just tell you it really helped me a lot. Please can you check out few of my blogs ? This is my Tech Blog i code and Please check out my personal blog too kamal thakur. For Latest news upadates and Latest Tech Tutorials please visit my website, Latest Tech Tutorials.

    ReplyDelete
  12. www.alltopstory.com
    special collection

    ReplyDelete
  13. I am very pleased to see this article, thank you for sharing.
    love marriage spell

    ReplyDelete
  14. Actually high quality content. As a part of discussion about this subject, your contribution is astonished.
    Black Magic Specialist

    ReplyDelete


  15. WWE PPV main events were rocking in 2015, hope this year it will rocks again, like all previous years all events were perfect now hope so this year also. It begins with royal rumble, then next WWE Fastlane 2016 live stream will be available on internet.
    Fastlane 2016 Results
    Fastlane 2016 Live Stream
    WWE Fastlane 2016 Live
    WWE Fastlane 2016 Live Stream
    Fastlane 2016 Winners


    Really Horror Show American Horror Story, i ever watched, here are some more interesting tv shows like the walking dead, arrow, Breaking Bad, Game of Thrones Season 6 Online we can stream, After watching these tv shows one can feel interested more an excited more.
    Game of Thrones Season 6
    Game of Thrones Season 6 Online
    Watch Game of Thrones Season 6
    Watch Game of Thrones Season 6 Online
    Game of Thrones Season 6
    Game of Thrones Season 6 Online
    Watch Game of Thrones Season 6
    Watch Game of Thrones Season 6 Online


    I watched this event, really very much interesting scenes created while selecting Miss Universe 2015. But here is one more .big event going to held Academy Awards 2016 here is direct link for this event.
    Academy Awards 2016 Nominations
    Oscar Awards 2016 Nominations
    Academy Awards 2016
    Oscar Awards 2016
    Academy Awards 2016 Live
    Oscar Awards 2016 Live
    Academy Awards 2016 Live Stream
    Oscar Awards 2016 Stream
    Academy Awards 2016 Winner
    Oscar Awards 2016 Winner

    All episodes of Torrent The Walking Dead Season 6 series are available here for viewers. These episodes can be watched online in HD Quality Like 1080 PX or 4K.
    The Walking Dead Season 6
    Walking Dead Season 6
    The Walking Dead Season 6 Online
    Walking Dead Season 6 Online
    Watch The Walking Dead Season 6
    Watch Walking Dead Season 6

    ReplyDelete
  16. I would like to thank you for the efforts you have made in writing this article.I would like to thank you for the efforts you have made in writing this article.
    Signature:
    i like play games game pacxon online and play games bubble trouble games

    ReplyDelete
  17. WhatsApp for PC and Xender for PC simple guides are given here https://forpcapp.com

    ReplyDelete
  18. This is a great article, that I really enjoyed reading. Thanks for sharing.

    weather
    facebook video downloader
    usps tracking
    youtube to mp3

    ReplyDelete
  19. Thanks for the valuable information. Your blog is really good and I have bookmarked it.
    Have a look at Python Lovers

    ReplyDelete
  20. Hi Admin,
    Actually first time i see your blog and it is very interesting and informative post thats why i made a comment on it.


    Happy Mothers Day 2016 | Happy Mothers Day Wishes | Happy Mothers Day Messages | Happy Mothers Day Quotes | Happy Mothers Day Sms | Happy Mothers Day Images


    Regards:
    Zeeshan Haider

    ReplyDelete
  21. This comment has been removed by the author.

    ReplyDelete
  22. On day, 2015 (PH Time), the official business got the opportunity to be made and he prevalent that he can go up against Tim Bradley for the 0.33

    time on April 9, 2015 and aswell the preoccupation are summon in MGM Fabulous region in burghal center, Nevada, u.s.a.. For the herald few

    canicule in 2015, that is for the most part to date the standard leisure activity that may be beddy-bye in pay as showed by secure in 2016 and

    nonexclusive to be the a variety of imperative energy to alpha out the yr.

    Pacquiao vs Bradley Live Stream



    Live Stream Boxing in Las Vegas Pacquiao Vs Bradley 3

    Manny Pacquiao is offered to life structures A business at Puerto RICO Act. An eagerness amidst adolescent Filipino Nonito Donaire adjoin Cesar

    Ciudad Juarez can show up and a couple of boxers are accessible to going to at the session. Bits of tattle get disentangle that Pacquiao is maybe

    to baddest Timothy Bradley or Publius Terentius Afer Crawford. swayer Khan is starting now incredible game plan confidentially as he are angry

    outskirt IBF Welterweight Champion Kell Rivulet. ‘Master Khan’ isn’t angry Pacquiao in this way, it’s starting now suitable down to two names.

    Timothy Bradley can action a specialist on the Donaire-Juarez improvement on Friday. a couple adumbrate that Bradley are a brief span later foe

    for Pacquiao lower back it limit aweless for Pacquiao to no more announcement Bradley on his broadcast. The Pacquiao versus Bradley 3 may

    improvement on April nine 2016, respectable clarifications are chargeless with the aide of Pacquiao’s impacted on day, 2015.

    Manny Pacquiao has missing adjoin Floyd Mayweather Jnr. bear may in like manner. For his change one year from now, it limit be a negligible one

    returned it limit be his withstand to he hangs his gloves. Pacquiao is conceivable to leave as a possible result of he are that speak to

    significant power in held nook as an administrators in his neighborhood u . s . a ., Philippines. Pacquiao is vivacious for a manager seat and

    choices is survived limit 2016. Pacquiao Vs Bradley Live Boxing Pacquiao vs Bradley Live

    “We don’t capacities Manny Pacquiao is going to assertion returned”, Bradley through and through . a couple ar blazing to butt Pacquiao’s next

    course and extension drinking spree adjoin any boxer may unmistakably collect his admirers alive. Bradley’s call has been growing a drivel lower

    back his contempo win add Brandon Rios. Bradley spared his sobriquet ANd residence Rios to a local retirement. Rios time-respected that his body

    isn’t about as suited as some time as of late. He had his time of first rate triumphs and early a retirement is wherever all boxers wrap up. To a

    couple, they recognize that it’s about unnecessarily local for Rios, making it difficult to accomplishment his movement calling. UN power is

    typical of he may most likely just suitable to blow and understand a bounce back http://pacquiao-vs-bradley-live-stream.com/live-boxing-las-vegas-pacquiao-vs-bradley-3/

    ReplyDelete

  23. You can check all details about education,results,and regular update about all information click here
    iResultsnic.in
    10th Results 2016
    12th Results 2016

    ReplyDelete

  24. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download

    Sp Flash Tools OR Sp Flash Tool Links for Download

    http://www.spflashtooldownload.com/

    ReplyDelete
  25. Hair transplant jungle get your silky hairhttp://hairtransplantjungle.blogspot.com for you in clicks

    ReplyDelete
  26. Thank you for sharing valuable information. Nice post. I enjoyed reading this post.
    Descargar Geometry Dash |Descargar Geometry Dash 2.0 |Geometry Dash|Geometry Dash 2.0 |

    ReplyDelete
  27. Thank you for sharing your thoughts.I truly appreciate your post thank you once again.
    minecraft games | fnaf |tetris - puzzle games
    abcdeya | brain games |happy wheels | agario hi

    ReplyDelete
  28. All fixed set patterns are incapable of adaptability or pliability. The truth is outside of all fixed patterns.
    - quotes about love
    - snake game
    - chinese food near me
    - panama papers
    - Fancam Kpop

    ReplyDelete
  29. To flee war, to protect the lives of themselves and their families Mario | Friv | Doraemon Games Busy life circumstances than the current world history.Thanks so much! Kizi | Yoob Juegos

    ReplyDelete
  30. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!

    hotmail sign in Hotmail is an email account of Microsoft Corporation. Like Google’s Gmail, it is full of the features of a regular email.

    hotmail login Hotmail was previously a quite popular email service. It has the features and utilities similar to other email services, but users encountered many annoying issues, and even lost fees they had paid for this service.


    recover hotmail password Therefore, there are many users who have a registered Hotmail account but no longer wish to use it as they are unhappy with the service.

    sign in to Hotmail  At this time, some users sought to remove their Hotmail account, but has some difficulties as it is a complicated process.

    ReplyDelete
  31. Great post, I am happy to find this post very useful for me.
    Open Facebook
    | Science Kombat
    | Science Kombat Game

    ReplyDelete
  32. Finding something that we used to do everyday is very nice and when I found something relevant to us that's great because as a programmer I know the importance this facts and figure with tips and tricks, currently I am developing an ps3 emulator for all PS players. Check it out and suggest what can be better to be implemented?

    ReplyDelete
  33. Hello Everyone This Website is too Good. I Must be Thankful for sharing Important Information in the Post and Please Visit my Website Once For More Details. Thanks

    www.pagalworldtop.in

    ReplyDelete
  34. Great! Thanks for sharing the information. That is very helpful for increasing my knowledge in this fiel
    Red Ball | | duck life | Slitherio
    Red Ball 2 | Red Ball 3 | Red Ball 4
    Gmail sign in | gmail login |

    ReplyDelete
  35. I love it!!! your website is awesome , great content, one of the best website i have ever visited.It has very useful features and content.
    Thanks.
    greets from http://www.crackorsquad.in/

    ReplyDelete
  36. I love it!!! your website is awesome , great content, one of the best website i have ever visited.It has very useful features and content.
    Thanks.

    ReplyDelete
  37. Hotmail is an email account of Microsoft Corporation. Like Google's Gmail, it is full of features usually xuyen.Neu of an email you want to register an account please follow these basic steps:
    Hotmail login

    Hotmail review

    Sign in to hotmail

    Login to hotmail

    Recover hotmail password

    Tank Trouble is a very interesting flash game about tanks, about war and about destruction
    TANK TROUBLE | TANK TROUBLE 2

    One Penguin Takes it personally when he is surfing the web and stumbles upon a web site telling him that he cant fly, after that he sets his mind to research and practice flying until he can prove the world that he can..
    Slitherio | LEARN TO FLY | LEARN TO FLY 2

    Strike Force Heroes is a new game action-packed shooter from the creators of Raze; with 3 game modes, 15 campaign missions and over 65 weapons.
    Strike Force Heroes 4

    Strike Force Heroes

    ReplyDelete
  38. Hotmail is an email account of Microsoft Corporation. Like Google's Gmail, it is full of features usually xuyen.Neu of an email you want to register an account please follow these basic steps:
    Hotmail login

    Hotmail review

    Sign in to hotmail

    Login to hotmail

    Recover hotmail password

    Tank Trouble is a very interesting flash game about tanks, about war and about destruction
    TANK TROUBLE | TANK TROUBLE 2

    One Penguin Takes it personally when he is surfing the web and stumbles upon a web site telling him that he cant fly, after that he sets his mind to research and practice flying until he can prove the world that he can..
    IO GAMES | Slitherio | LEARN TO FLY | LEARN TO FLY 2

    Strike Force Heroes is a new game action-packed shooter from the creators of Raze; with 3 game modes, 15 campaign missions and over 65 weapons.
    Strike Force Heroes 4

    Strike Force Heroes

    ReplyDelete
  39. The war between humans, orcs and elves continues. Lead your race through a series of epic battles, using your crossbow to fend off foes and sending out units to destroy castles. Researching and upgrading wisely will be crucial to your success!
    slitherio | unfair mario 2 | age of war 2
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    cubefield | tank trouble | happy wheels |gold miner |
    age of war 6 | duck life

    ReplyDelete
  40. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.
    Vex 2 Game | mobogenie market | mobogenie baixar | clickjogos | descargar whatsapp | Banana Kong | drag racer | solitaire card games | dhl tracking number

    ReplyDelete
  41. Thanks a lot for the post. It has helped me get some nice ideas. I hope I will see some really good result soon.
    Cold Fusion Project Help

    ReplyDelete
  42. good work indeed, thanks please follow the link and Download clash of Clans for PC

    ReplyDelete
  43. Whatsapp for PC now available for computer and you can check this post to know more about this thing.

    ReplyDelete
  44. Happy diwali 2016 Status pictures, Messages and Wishes

    ReplyDelete
  45. very nice post. i love your every post. some time i think how you post like this. amazing post.
    happy new year 2017 Best wishes

    ReplyDelete
  46. تعتبر العاب طبخ جديدة الاكتر شهرة وطلبا في النت فكل الفئات تحبها منها الصغار والكبار و الاولاد و البنات وهي بداتها تحتوي على عدة اصناف وبعدما اصبحت تعرف نجاحا كبيرا اصبحت منتشرة بكترة بين المواقع والكل يحاول تقديم كل ماهو جديد وممتاز فيها ونحن اليوم نقدم لكم نموذج بسيط منها صحيح ان مدونتنا لها اختصاص في تقديم وطرح العاب بنات لكن هذا لا يمنع من ان نغير قليلا وننوع حتى تصبح لدينا تشكيلة جميلة من الالعاب التي ترضي جميع الاذواق فلألعاب الطبخ عشاق ومحبين كتر ويلعوبنها يوميا وقد تساعدهم ايضا على اكتساب مهارات الطبخ في حياتهم اليومية ويمكنهم تطبيق ذلك في الواقع كما ان بعض الالعاب تشرح وتبين طريقة الطبخ و الطي واستعمال الوسائل بدقة عالية وكأنها حقيقية وتحرص ايضا على استخدام كل اداة في وقتها المحدد ووضع التوابل ولوازم الطبخ في وقتها المناسب حتى تكون نتيجة الاكلة جيدة ولذيذة وغير ذلك فهناك بعضها يطلب منك الطي في وقت محدد لان الطبخ ايضا يحتاج السرعة لكي يكون جاهزا في وقته وان تم تجهيزه في وقت متأخر يكون صعب اكله او يكون قد فقد قيمته المعتادة في الكل معتاد على ان يأكل في وقت معيين لهذا فمعيار الوقت في مجال الطبخ يعتبر مهم جدا ولا يجب تجاهله وبالنسبة للمتال الدي قدمناه لكم اليوم هو هذه اللعبة التي تطلب منكم وضع كل شيء بالتتابع والتركيز على وضع كل التوابل اللازمة وفي الاخير ستقومون بطي اللحوم وتقديمها في طبق هذا امر يحتاج وقت وتركيز لهذا عند لعبها يجب التركيز جيدا لكي تتجنبوا التعقيدات وتكون النتيجة مرضية لتعطينا طبق جاهز وشهي ونلتقي في وقت لاحق معة لعبة اخرى جديدة وكان موضوعنا اليوم يقدم نموذج فقط اما العاب طبخ فهي كتيرة ومتنوعة وتزداد يوما بعد الاخر وذلك بفضل كترة المواقع المتخصصة فيها وهي بدورها تحتوي على اصناف وفروع فبعد ان كان موقعنا له تعلق بمجال التلبيس فقط خلال فتحه لكن مع مرور الوقت والسنين بدأ يشمل الكتير من الانواع وخاصة انواع للبنات وهذا ما جعلنا نعطي لنوع العاب طبخ بنات حقه في الايام القادمة وسنضل نعطي كل صنف اهتمام حتى نحصل في الاخير عن الشمولية لنكون تشكيلة جميلة ومميزة ترضي كل الاضواق ولحد الان لازلنا في قيد تطوير المدونة وهناك جهود مبدولة بشكل يومي حتى نوصل لزائرنا الكريم ما يبحت عنه بالضبط بدون عناء او صعوبة ودائما ما نراجع اراء و اقتراحات الزوار في التعليقات التي توجد في كل الالعاب التي نطرحها لكي نحاول قدر الامكان الوصول الى عقل زائرنا العزيز ومعرفة ما يحبه بالضبط وبمناسبة اقتراب السنة الجديدة اكيد ستظهر الكتير من الالعاب الجديدة التي ستكون ممتازة فالجديد دائما يكون اجمل لهذا ما عليكم سوى انتظار العاب طبخ 2017 القادمة كي تستمتعو بها وسنعمل كل ما في وسعنا لكي يصلكم كل الجديد وبهذه المناسبة نريد ان نوضح ان هناك الكتير من الالعاب الخاصة بالطبخ في الاسفل يمكنكم الاطلاع عليها والاستمتاع بها وان اعجبتكم شاركوها مع اصدقائكم فاكيد سنكون سعداء بذلك وشكرا لجميع الاوفياء الدين يزوروننا باستمرار ومرحبا بالجدد ايضا .
    العاب بنات مكياج
    العاب بنات ستايل
    العاب بنات باربي
    العاب بنات تلبيس ومكياج
    العاب بنات طبخ
    العاب بنات كبار
    العاب بنات جديدة وجميلة جدا

    ReplyDelete
  47. First of all i am saying that i like your post very much.I am really impressed by the way in which you presented the content and also the structure of the post. Hope you can gave us more posts like this and i really appreciate your hardwork.

    Teddy Day 2017
    Happy New Year 2018 GIF
    valentine week date 2019
    symbols status whatsapp
    Good Night Messages
    Birthday Wishes for Father
    Happy New Year 2017 Greetings

    ReplyDelete
  48. This is the game so players feel very fierce , adventurous . You try to join and play this game , you will feel great like.
    | tank trouble | learn to fly
    gun mayhem | can your pet
    | happ wheels

    ReplyDelete


  49. This is the game so players feel very fierce , adventurous . You try to join and play this game , you will feel great like.
    | tank trouble 3 | | happy wheels game
    gun mayhem 3 | gun mayhem 3
    learn to fly 3

    ReplyDelete
  50. This comment has been removed by the author.

    ReplyDelete
  51. Thanks for sharing. I hope it will be helpful for too many people that are searching for this topic. thought elevators reviews

    ReplyDelete
  52. With New Year 2017 around the corner, internet searches for New Year Status for WhatsApp Hindi have been booming in India. New Year is the time for celebrations and parties

    ReplyDelete
  53. Download facetime and Enjoy video Calling on yo device

    ReplyDelete
  54. Obrigado pela informação Você é tão interessante! Eu não acho que eu realmente tenha lido algo como isso antes. Tão grande para encontrar outra pessoa com alguns pensamentos únicos sobre esta questão. Realmente .. tanque você para começar este up.This site é uma coisa que é necessário na web, alguém com um pouco de originalit Ano Novo 2017

    ReplyDelete
  55. thanks for the information keep writing such amazing articles
    AUGURI DI BUON ANNO 2017

    ReplyDelete
  56. UFC 207 Live, Fight Card, Time, Stream, Rousey vs Nunes, PPV: UFC 207

    ReplyDelete
  57. I am going to Tweet this post, awesome read!
    Thanks for sharing
    سلامت

    ReplyDelete
  58. I am going to Tweet this post, awesome read!
    Thanks for sharing
    سلامت

    ReplyDelete
  59. tech blog one of the best tech blog of this tech world which is advancing at an unreliable rate.

    ReplyDelete