Hacker News Reader

Comment by chris_j | Hacker News Reader

The perverse thing about terms forbidding deep linking into a website is that it is so easy to prevent deep linking by technical means. (In fact, it's so easy that even mentioning it seems like a cliche.) On each HTTP request, examine the Referer: header and, if you don't like it, redirect to your homepage. Is there any reason why companies like Ryanair don't just do this?

View on HN

Because these companies don't really want to forbid deep-linking, but establish some kind of recourse (regardless of whether it is legally enforceable, or just scary and threatening) against anyone who might offend them in some way.

It's a blacklist, which inherently have their issues. Remember, this is Ryanair, that would mean their steward(esse)s have yet another task to do on their cell phones while supervising the boarding of 3 simultaneous flights.

Actually, it's more like a whitelist - much easier to maintain if they really want to explicitly approve inbound link sites.

Because circumventing that filter is even easier than installing the filter in the first place?

Circumventing that filter is easy for the user, but I don't see how it's easy for the referring website.

A referrer is not sent when following a link from a secure website (https) to a non-secure website.

http://tools.ietf.org/html/rfc2616#section-15.1.3

Thanks for the information. I had not realised that. There are still plenty of other measure that Ryanair could use, of course, in the case where there was no Referer: header, such putting some unique (and constantly changing) id into a cookie such that links from another site wouldn't have the correct id. As other have suggested, perhaps they are perfectly happy with most deep links into their site, just not from certain sites such as price comparison sites. Far be it from me to speculate about such things, of course.

I would assume that the filter would be implemented to deny/redirect the request if there were no referrer at all.

From context, I assumed we were talking about users following deep links. This can be prevented technologically by the target website, and the burden of circumvention is obviously on the user.

Obviously there is no technological way to prevent "deep linking" by the referring website, because that is just creating an <a> tag.

It's not easy for the general ryanair customer. The average person doesn't know what a referrer header is.

Reply on news.ycombinator.com