Sunday, November 20, 2011

Referer (sic)

One of the more astonishing facets of the web platform is the Referer header.  Whenever you click a link from one web site to another, the request that fetches the web page from the second web site contains the URL of the first web site.  This behavior causes both security and privacy problems:
  1. Security.  Despite copious warnings, developers often include secrets in URLs.  For example, to prevent Cross-Site Request Forgery (CSRF), developers often use secret tokens, which have a nasty habit of leaking into URLs and then into Referer headers sent to other sites.
  2. Privacy.  The Referer header is even worse for privacy, for example, leaking search terms from your favorite search engine to the web sites you visit.  As another example, Facebook accidentally leaked user identities to advertisers via the Referer header.
The principle of least astonishment tells us we should remove this "feature", but, unfortunately, we can't just remove the Referer header from the platform.  To many people rely on the Referer header for too many different purposes.  For example, bloggers rely on the Referer header to generate trackback links, but that's just the tip of the iceberg.

As a first step, I wrote up a short proposal for a mechanism web sites can use to suppress or truncate the Referer header:
<meta name="referrer" content="never">
<meta name="referrer" content="origin">
One subtlety in the design is including the "always" option.  The main reason to include this option is to make it easier for us to later block the Referer header by default.  The always options gives sites an escape valve to turn the Referer header back on, if needed.

This mechanism is now implemented in WebKit and will hopefully be implemented in Firefox and other browsers soon.

458 comments:

  1. It seems to me that the https behavior for always violates the least astonishment for developers.

    Additionally, not sure if this is a resource level property (thus implemented at the document) or a web application level property (thus implemented maybe via CSP that can be set by the web application admin).

    ReplyDelete
  2. Yeah, we'll probably want to add a directive to CSP to control this policy. That's probably something good to consider for CSP 1.1. Please feel encouraged to add it to this wiki page:

    http://www.w3.org/Security/wiki/Content_Security_Policy

    ReplyDelete
  3. Ironically, people also use Referer header fields to defend against CSRF.

    ReplyDelete
  4. Also, maybe spelling it correctly here (as opposed to the header field name) will cause unnecessary confusion... (maybe this is a case where both need to be allowed?)

    ReplyDelete
  5. Typically, we spell it correctly when we refer to it in the DOM. For example, noreferrer and document.referrer both spell it correctly.

    ReplyDelete
  6. Some people use it against hot linking.

    ReplyDelete
  7. I noticed that "never" and "always" answer to the question "when?", but "origin" answers to "what?".

    Shouldn't it be something like "none", "origin" and "full"? Or maybe "no", "yes" and "origin".

    ReplyDelete
  8. Hi Admin,

    Well understanding meta referrer is very tricky to me, though your post take me to right direction in order to understand how it works!

    Thanks!

    ReplyDelete
  9. Thanks for all your information, Website is very nice and informative content.

    JAHRESHOROSKOP 2016
    HOROSKOP ZA 2016
    HOROSKOP NA 2016
    horoscopo 2016
    horoscopo aries 2016
    horoscopo libra 2016

    Thanks for all your information, Website is very nice and informative content.

    feliz ano novo 2016
    mensagem para 2016
    imagens de feliz ano novo 2016
    frases de feliz ano novo 2016



    Thanks for all your information, Website is very nice and informative content.

    Saint Valentin 2016
    st valentin 2016
    san valentin 2016

    ReplyDelete

  10. dia de san valentin 2016,valentines day 2016,valentinstag 2016

    Thanks for all your information, Website is very nice and informative content.
    valentines day 2016
    valentines gift 2016
    happy valentines day 2016
    whens valentines day 2016
    valentines day images 2016
    valentine day sms 2016


    Thanks for all your information, Website is very nice and informative content.
    dia de san valentin 2016
    san valentin 2016

    Thanks for all your information, Website is very nice and informative content.
    valentinstag
    valentinstag 2016
    valentinstag 2016 geschenke

    ReplyDelete
  11. Christmas is an annual festival commemorating the birth of Jesus Christ, observed most commonly on December 25. baby new year coloring pages Many cultures celebrate the event in some manner

    ReplyDelete
  12. Hey Thanks for sharing this beautiful article and I wanna just tell you it really helped me a lot. Please can you check out few of my blogs ? This is my Tech Blog i code and Please check out my personal blog too kamal thakur. For Latest news upadates and Latest Tech Tutorials please visit my website, Latest Tech Tutorials.

    ReplyDelete
  13. www.alltopstory.com
    special collection

    ReplyDelete
  14. I am very pleased to see this article, thank you for sharing.
    love marriage spell

    ReplyDelete
  15. Actually high quality content. As a part of discussion about this subject, your contribution is astonished.
    Black Magic Specialist

    ReplyDelete


  16. WWE PPV main events were rocking in 2015, hope this year it will rocks again, like all previous years all events were perfect now hope so this year also. It begins with royal rumble, then next WWE Fastlane 2016 live stream will be available on internet.
    Fastlane 2016 Results
    Fastlane 2016 Live Stream
    WWE Fastlane 2016 Live
    WWE Fastlane 2016 Live Stream
    Fastlane 2016 Winners


    Really Horror Show American Horror Story, i ever watched, here are some more interesting tv shows like the walking dead, arrow, Breaking Bad, Game of Thrones Season 6 Online we can stream, After watching these tv shows one can feel interested more an excited more.
    Game of Thrones Season 6
    Game of Thrones Season 6 Online
    Watch Game of Thrones Season 6
    Watch Game of Thrones Season 6 Online
    Game of Thrones Season 6
    Game of Thrones Season 6 Online
    Watch Game of Thrones Season 6
    Watch Game of Thrones Season 6 Online


    I watched this event, really very much interesting scenes created while selecting Miss Universe 2015. But here is one more .big event going to held Academy Awards 2016 here is direct link for this event.
    Academy Awards 2016 Nominations
    Oscar Awards 2016 Nominations
    Academy Awards 2016
    Oscar Awards 2016
    Academy Awards 2016 Live
    Oscar Awards 2016 Live
    Academy Awards 2016 Live Stream
    Oscar Awards 2016 Stream
    Academy Awards 2016 Winner
    Oscar Awards 2016 Winner

    All episodes of Torrent The Walking Dead Season 6 series are available here for viewers. These episodes can be watched online in HD Quality Like 1080 PX or 4K.
    The Walking Dead Season 6
    Walking Dead Season 6
    The Walking Dead Season 6 Online
    Walking Dead Season 6 Online
    Watch The Walking Dead Season 6
    Watch Walking Dead Season 6

    ReplyDelete
  17. I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again..
    animal jam| cool games| cool math games| 8 ball pool| sudoku| yoob| stickman games| unblocked games | shooting games| friv4school|
    happy wheels| fighting games

    ReplyDelete
  18. I would like to thank you for the efforts you have made in writing this article.I would like to thank you for the efforts you have made in writing this article.
    Signature:
    i like play games game pacxon online and play games bubble trouble games

    ReplyDelete
  19. WhatsApp for PC and Xender for PC simple guides are given here https://forpcapp.com

    ReplyDelete
  20. This is a great article, that I really enjoyed reading. Thanks for sharing.

    weather
    facebook video downloader
    usps tracking
    youtube to mp3

    ReplyDelete
  21. Thanks, you guys that is a great explanation. keep up the good work in your granite blog.
    agario
    happy wheels
    car games
    pacman
    plants vs zombies
    solitaire

    ReplyDelete
  22. Thanks for the valuable information. Your blog is really good and I have bookmarked it.
    Have a look at Python Lovers

    ReplyDelete
  23. Hi Admin,
    Actually first time i see your blog and it is very interesting and informative post thats why i made a comment on it.


    Happy Mothers Day 2016 | Happy Mothers Day Wishes | Happy Mothers Day Messages | Happy Mothers Day Quotes | Happy Mothers Day Sms | Happy Mothers Day Images


    Regards:
    Zeeshan Haider

    ReplyDelete
  24. This comment has been removed by the author.

    ReplyDelete
  25. Busy life circumstances than the current world history.
    Mario | Friv | Doraemon Games | Kizi | Yoob

    ReplyDelete
  26. Very helpful advice in this particular post! It’s the little changes that make the largest changes. Thanks for sharing!
    Descargar Geometry Dash |Descargar Geometry Dash 2.0 |Geometry Dash|Geometry Dash 2.0 |

    ReplyDelete
  27. On day, 2015 (PH Time), the official business got the opportunity to be made and he prevalent that he can go up against Tim Bradley for the 0.33

    time on April 9, 2015 and aswell the preoccupation are summon in MGM Fabulous region in burghal center, Nevada, u.s.a.. For the herald few

    canicule in 2015, that is for the most part to date the standard leisure activity that may be beddy-bye in pay as showed by secure in 2016 and

    nonexclusive to be the a variety of imperative energy to alpha out the yr.

    Pacquiao vs Bradley Live Stream



    Live Stream Boxing in Las Vegas Pacquiao Vs Bradley 3

    Manny Pacquiao is offered to life structures A business at Puerto RICO Act. An eagerness amidst adolescent Filipino Nonito Donaire adjoin Cesar

    Ciudad Juarez can show up and a couple of boxers are accessible to going to at the session. Bits of tattle get disentangle that Pacquiao is maybe

    to baddest Timothy Bradley or Publius Terentius Afer Crawford. swayer Khan is starting now incredible game plan confidentially as he are angry

    outskirt IBF Welterweight Champion Kell Rivulet. ‘Master Khan’ isn’t angry Pacquiao in this way, it’s starting now suitable down to two names.

    Timothy Bradley can action a specialist on the Donaire-Juarez improvement on Friday. a couple adumbrate that Bradley are a brief span later foe

    for Pacquiao lower back it limit aweless for Pacquiao to no more announcement Bradley on his broadcast. The Pacquiao versus Bradley 3 may

    improvement on April nine 2016, respectable clarifications are chargeless with the aide of Pacquiao’s impacted on day, 2015.

    Manny Pacquiao has missing adjoin Floyd Mayweather Jnr. bear may in like manner. For his change one year from now, it limit be a negligible one

    returned it limit be his withstand to he hangs his gloves. Pacquiao is conceivable to leave as a possible result of he are that speak to

    significant power in held nook as an administrators in his neighborhood u . s . a ., Philippines. Pacquiao is vivacious for a manager seat and

    choices is survived limit 2016. Pacquiao Vs Bradley Live Boxing Pacquiao vs Bradley Live

    “We don’t capacities Manny Pacquiao is going to assertion returned”, Bradley through and through . a couple ar blazing to butt Pacquiao’s next

    course and extension drinking spree adjoin any boxer may unmistakably collect his admirers alive. Bradley’s call has been growing a drivel lower

    back his contempo win add Brandon Rios. Bradley spared his sobriquet ANd residence Rios to a local retirement. Rios time-respected that his body

    isn’t about as suited as some time as of late. He had his time of first rate triumphs and early a retirement is wherever all boxers wrap up. To a

    couple, they recognize that it’s about unnecessarily local for Rios, making it difficult to accomplishment his movement calling. UN power is

    typical of he may most likely just suitable to blow and understand a bounce back http://pacquiao-vs-bradley-live-stream.com/live-boxing-las-vegas-pacquiao-vs-bradley-3/

    ReplyDelete

  28. You can check all details about education,results,and regular update about all information click here
    iResultsnic.in
    10th Results 2016
    12th Results 2016

    ReplyDelete

  29. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download

    Sp Flash Tools OR Sp Flash Tool Links for Download

    http://www.spflashtooldownload.com/

    ReplyDelete
  30. Hair transplant jungle get your silky hairhttp://hairtransplantjungle.blogspot.com for you in clicks

    ReplyDelete
  31. Thank you for sharing valuable information. Nice post. I enjoyed reading this post.
    Descargar Geometry Dash |Descargar Geometry Dash 2.0 |Geometry Dash|Geometry Dash 2.0 |

    ReplyDelete
  32. Thank you for sharing your thoughts.I truly appreciate your post thank you once again.
    minecraft games | fnaf |tetris - puzzle games
    abcdeya | brain games |happy wheels | agario hi

    ReplyDelete
  33. All fixed set patterns are incapable of adaptability or pliability. The truth is outside of all fixed patterns.
    - quotes about love
    - snake game
    - chinese food near me
    - panama papers
    - Fancam Kpop

    ReplyDelete
  34. gmail sign in

    Using Google’s Gmail as your email service makes accessing messages convenient from any computer by visiting Google and logging in to your Gmail account. Instead of opening the browser, navigating to the Google website and clicking “Gmail,” createa shortcut to Gmail on your computer’s desktop for quicker access.
    what's gmail

    gmail tips

    ReplyDelete
  35. Thanks for the best blog.it was very useful for me.keep sharing such idea
    s in the future as well.this was actually what i was looking for,and i
    am glad to came here
    you keep up the fantastic work!my weblog
    age of war
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels

    tank trouble 3

    ReplyDelete
  36. To flee war, to protect the lives of themselves and their families Mario | Friv | Doraemon Games Busy life circumstances than the current world history.Thanks so much! Kizi | Yoob Juegos

    ReplyDelete
  37. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!

    hotmail sign in Hotmail is an email account of Microsoft Corporation. Like Google’s Gmail, it is full of the features of a regular email.

    hotmail login Hotmail was previously a quite popular email service. It has the features and utilities similar to other email services, but users encountered many annoying issues, and even lost fees they had paid for this service.


    recover hotmail password Therefore, there are many users who have a registered Hotmail account but no longer wish to use it as they are unhappy with the service.

    sign in to Hotmail  At this time, some users sought to remove their Hotmail account, but has some difficulties as it is a complicated process.

    ReplyDelete
  38. Great post, I am happy to find this post very useful for me.
    Open Facebook
    | Science Kombat
    | Science Kombat Game

    ReplyDelete
  39. Finding something that we used to do everyday is very nice and when I found something relevant to us that's great because as a programmer I know the importance this facts and figure with tips and tricks, currently I am developing an ps3 emulator for all PS players. Check it out and suggest what can be better to be implemented?

    ReplyDelete
  40. Hello Everyone This Website is too Good. I Must be Thankful for sharing Important Information in the Post and Please Visit my Website Once For More Details. Thanks

    www.pagalworldtop.in

    ReplyDelete

  41. check out..! Here you get UEFA Euro Cup 2016 Live Streaming , UEFA Euro cup 2016 Highlights , Euro cup 2016 Points Table , UEFA 2016 Results , UEFA Euro cup 2016 schedule

    UEFA Euro Cup 2016 Live Streaming

    http://wsoccerpicks.com/

    ReplyDelete
  42. The war between humans, orcs and elves continues. Lead your race through a series of epic battles, using your crossbow to fend off foes and sending out units to destroy castles. Researching and upgrading wisely will be crucial to your success!
    age of war 3 | age of war 2 | unfair mario 2 | tank trouble 3 | tank trouble
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    cubefield | tank trouble | happy wheels | slitherio | gold mine

    ReplyDelete
  43. I love how you still write and share about your day and experiences! You feel like such a real, nice, and humble person because of this!
    dark souls iii emoji keyboard
    slither.io supersnake.io

    ReplyDelete
  44. Great! Thanks for sharing the information. That is very helpful for increasing my knowledge in this fiel
    Red Ball | | duck life | Slitherio
    Red Ball 2 | Red Ball 3 | Red Ball 4
    Gmail sign in | gmail login |

    ReplyDelete
  45. Thanks for sharing this quality information with us. I really enjoyed reading.
    slither io | wings io | science kombat | tank trouble 4

    ReplyDelete
  46. Thanks for sharing this quality information with us. I really enjoyed reading.
    slither io | wings io | science kombat | tank trouble 4

    ReplyDelete
  47. I love it!!! your website is awesome , great content, one of the best website i have ever visited.It has very useful features and content.
    Thanks.
    greets from http://www.crackorsquad.in/

    ReplyDelete
  48. I love it!!! your website is awesome , great content, one of the best website i have ever visited.It has very useful features and content.
    Thanks.

    ReplyDelete
  49. Hotmail is an email account of Microsoft Corporation. Like Google's Gmail, it is full of features usually xuyen.Neu of an email you want to register an account please follow these basic steps:
    Hotmail login

    Hotmail review

    Sign in to hotmail

    Login to hotmail

    Recover hotmail password

    Tank Trouble is a very interesting flash game about tanks, about war and about destruction
    TANK TROUBLE | TANK TROUBLE 2

    One Penguin Takes it personally when he is surfing the web and stumbles upon a web site telling him that he cant fly, after that he sets his mind to research and practice flying until he can prove the world that he can..
    Slitherio | LEARN TO FLY | LEARN TO FLY 2

    Strike Force Heroes is a new game action-packed shooter from the creators of Raze; with 3 game modes, 15 campaign missions and over 65 weapons.
    Strike Force Heroes 4

    Strike Force Heroes

    ReplyDelete
  50. Hotmail is an email account of Microsoft Corporation. Like Google's Gmail, it is full of features usually xuyen.Neu of an email you want to register an account please follow these basic steps:
    Hotmail login

    Hotmail review

    Sign in to hotmail

    Login to hotmail

    Recover hotmail password

    Tank Trouble is a very interesting flash game about tanks, about war and about destruction
    TANK TROUBLE | TANK TROUBLE 2

    One Penguin Takes it personally when he is surfing the web and stumbles upon a web site telling him that he cant fly, after that he sets his mind to research and practice flying until he can prove the world that he can..
    IO GAMES | Slitherio | LEARN TO FLY | LEARN TO FLY 2

    Strike Force Heroes is a new game action-packed shooter from the creators of Raze; with 3 game modes, 15 campaign missions and over 65 weapons.
    Strike Force Heroes 4

    Strike Force Heroes

    ReplyDelete
  51. Welcomes to google terminal keep sharing such ideas in the future as well.
    google snake this was actually EARN TO DIE
    what i was looking for,and i am glad to came here! AGE OF WAR 2
    Hi! I’ve been reading your blog for a while HAPPY WHEELS
    I want you to thank for your time of this wonderful read!!! Slitherio
    Amazing insight you have on this, Slither io This article always blew me BIG FARM

    ReplyDelete
  52. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    strike force heroes| slitherio | earn to die 2
    earn to die 5| goodgame empire |tank trouble 2

    ReplyDelete
  53. The war between humans, orcs and elves continues. Lead your race through a series of epic battles, using your crossbow to fend off foes and sending out units to destroy castles. Researching and upgrading wisely will be crucial to your success!
    slitherio | unfair mario 2 | age of war 2
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    cubefield | tank trouble | happy wheels |gold miner |
    age of war 6 | duck life

    ReplyDelete
  54. Online gaming is a hobby of many people. Game Run Unblockedversions as Run 3 Unblocked or Run 4 Unblocked is a very interesting game to control the bear run or jump to the safe landing area falls. risks with such racing game Car Racing Games or interesting as the game Donkey Kong Unblocked or Car Racing Games wrap pulled a lot of players. Good luck!

    ReplyDelete
  55. With football we always have exciting games such as head soccer and head soccer unblocked and soccer heads and head soccer 2 or big head basketball big head soccer or head soccer will bring to everyone the good entertainment Best. After work you can play with Big Head Football and Big Head Soccer or Head Soccer to reduce the pressure of work. With big head basketball

    ReplyDelete
  56. Head Soccer and Big Head Football you will have the best experience on the sport king. big head basketball and Head Soccer and Big Head Soccer and Big Head Football will make the most demanding on electronic games must also satisfied. Come to Big Head Football and big head basketball and Big Head Soccer to experience the most wonderful thing. Thank you.

    ReplyDelete

  57. This app is great it gives you those moments of relaxation and incredibly wonderful
    age of war 2 | tank trouble | gold miner | tank trouble 3 | duck life
    Game is a must play game and the modern class:
    age of war 3 | red ball | Stick war 2 | Apple Shooter | goodgame empire | earn to die | tank trouble 2

    ReplyDelete
  58. I want to share any applications example baixar snapchat, google play and play store. Snapchat is app which everybody like, it's chat app. Baixar google play and play store are two applications of google. It allows you download applications and games which you like. Please, baixar play store to mobile to experience

    ReplyDelete
  59. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.
    Vex 2 Game | mobogenie market | mobogenie baixar | clickjogos | descargar whatsapp | Banana Kong | drag racer | solitaire card games | dhl tracking number

    ReplyDelete
  60. A good blog always comes-up with new and exciting information and while reading I have feel that this blog is really have all those quality that qualify a blog to be a one.I wanted to leave a little comment to support you and wish you a good continuation.


    https://www.webtechera.com dp for whatsapp line on pc xender on pc candy crush on pc instagram on pc wechat on pc download bbm on pc facetime to pc kik on pc
    viber on pc mx player on pc create apple id without credit card uc browser on pc whatsapp on pc micromax pc suit

    ReplyDelete
  61. I was working and suddenly I visits your site frequently and recommended it to me to read also. Age Of War 2
    Big Farm | Slitherio
    Tank Trouble | Happy Wheels
    Goodgeme Empire | Slither.io

    ReplyDelete