This makes me wonder why the hell referer headers are still sent by major browsers, especially to third parties. I can’t think of a single reason that benefits the user.
Originally it probably just sounded like a cool feature to see what blog linked to you. Now its been around for so long that so much has been programmed to actually use it. If you turn it off you get every anti bot script blowing up on you.
I think browsers did drop the path from it at least.
For one thing, examining referer is a common way that a server determines a request is not a hotlink. Sure you can do something more complicated with cookies or whatever, but lots of sites are just using referer and they'll break if the client doesn't send it.
But for that it's enough to send it for same-origin requests. No need to send it cross-origin, except for tracking purposes.
That'd still break the distinction between hotlinking and the user using a bookmark or copy/paste to directly open the URL in question.
Letting the sites distinguish between the two does not seem to be in the interest of the user.
Well, it'd mean that any site blocking hotlinking would also automatically block direct bookmarks/URL entry, too, which isn't really in the "interest of the user" either, I'd say.
If Chrome suddenly stopped sending referrer headers, let's be real here, 99% of websites would be fixed within a couple of days at most.
if you are making any sort of content or running a website, it is really useful to know how people found you.