Hacker News Reader

Comment by merb | Hacker News Reader

why tf should removing Referer break sites? who uses Referer?! the only thing that Referer brought were privacy leaks.

Some websites would whitelist referrers to prevent hotlinking resources from other websites (incurring potentially high bandwidth costs).

But overall I'm all for getting rid of it. It's a remnant of the early web that doesn't make a lot of sense these days, and creates more problems than it solves.

EDIT: Although I just realized that strict-origin-when-cross-origin (the new policy) would still let the hotlinking detection use case work, since you typically only need domain information for that. I initially thought that they would use same-origin or something like that. It'll teach me to comment before I read the linked story.

VictorOps uses referrers as a "security measure" on login. So I just have a separate profile of firefox without my antireferrer addon

> VictorOps uses referrers as a "security measure" on login.

Using the referrer header as a security and privacy measure is prevalent among service providers. Vimeo even hilariously charges for this feature which is trivially bypassed; and I'd reckon their paying customers aren't even aware of it: https://vimeo.zendesk.com/hc/en-us/articles/224819527-Changi...

Talk about smoke and mirrors.

Maybe they advertise it as a security feature but it's still a good way to prevent unauthorized hotlinking that burns your vimeo bandwidth, costing you money (assuming it does indeed prevent random websites from embedding your videos).

This reminds me of some vague memories of a time long ago where some websites had a secure login page that asks for a username&pw but every other page after just checked the referall header. It wasn't a very secure system and people shared the header values needed to bypass logging in.

That's basically a degenerate form of capability-based security. Sharing the referrer header is delegating access rights. Of course, that's not actually a property you want in this case.

I've started to see quite a bit of that on websites dealing with transfer of medical data. I figured it was probably some sort of an effort to handicap MITM potential of impostor websites that were trying to steal credentials. My theory is that it might be some sort of a tripwire for the website to detect fishiness and lock the account.

Twitter does this and more

I can't think of a single use case where a user would want a target site to know where they came from. Put that in the URL or something less nefarious if you want to communicate state.

Twitter have started doing this via their embed widgets/scripts.

I want some news sites to think I came from Google, because they will give up whole articles that are otherwise paywall-blocked. It's a dark SEO trick.

who uses Referer?!

How can you tell it's Monday morning on HN?

Someone starts pontificating, "I don't use this, so there is no conceivable reason that anyone else on the planet should ever need this ever!"

See also: Half of StackOverflow questions.

Well, who does?

pcpartpicker does

And likewise, the other sign it's Monday morning is when someone starts pontificating "this exists for some reason, so there must be someone using it for non-malicious purposes".

Which very well might be true, but that was exactly the question: who?

I use it to understand which site or link the user used to find an outdated link on our site. It's very helpful to know how he got there because often the references to that obsolete link are all purged in the code but somewhere deep inside the database or CMS somebody still put a link to the obsolete page.

well you can turn the header off pretty easily and you won't see many sites are breaking (alexa top 100), of course some wierd sites think it's important to use it, but because of the madness of referer there are so many things that will leak your privacy extremly, it came to the point that it's necessary to have extensions to remove the header or at least inject noreferer into a tags.

I turned it off once and the most common breakages were usually authentication that involves some kind of OpenID delegation.

Yeah, we (Azure AD) got a couple of "login is broken" escalations when Chrome made this change. A couple vendors use it to validate a request is coming from the upstream IDP, to block drive by attacks I assume.

The first thing I thought of was when you go to a URL but it requires a login so it redirects you to the login page but then redirects you back to your original page after you login. Pretty sure it’s easily remedied without referer but that was the first thing I thought about.

If the login is on the same site, this change won't affect that, as this change only applies to cross-original requests.

that is a security issue on it's own. you should never have an openredirect bug, that's why openid servers need to store redirect uris somewhere and validate them.

Some ad networks use(d to use) referers for brand safety when resource serving an ad is embedded iframe. For example if the parent URL contains "osama-bin-laden-killed", don't display ad about nice family moments together (or anything else, likely)

Or keep track of your internet history to have a more accurate profile of you. This is not a good thing and it's precisely why it's a privacy leak.

Referer is an important way to maintain the security of an OAuth flow.

I don't know how commonly it would break that flow, but it certainly could depending on implementation details that are not narrowly prescribed by the OAuth2 spec.

no referer is an important way to screw your security in an oauth2 flow. with oauth2 a correct configuration would be Referrer-Policy: no-referrer and enforcing a secure state param and csrf.

> Referer is an important way to maintain the security of an OAuth flow.

How? Referrer can be easily spoofed.

The scenario is that the user is being phished with an uncompromised, modern browser. The idea is that if the attacker doesn't have control of the browser, they can't spoof the referer.

Isn't it also sort of useful information for site owners even if they are not maliciously slurping your private information?

For example you might not know that important site X linked to you and is driving Y% of your audience. You are not necessarily interested in the individuals following the links when you discover that.

This change only trims the referrer string, it doesn't remove the origin domain info. You can still tell that "important site X linked to you and is driving Y% of your audience." You just wouldn't be able to get any more granular than that.

I believe jwz rather famously does. Let's see:

https://www.jwz.org/blog/2021/03/cursed-keyboard-image/

His use only needs the domain, so should be unaffected? That said, something from my browser, probably ETP strict mode, appears to be stripping out the referrer entirely already anyway.

I'm not following that on the assumption is he the guy that shows HN users the goatse image?

If so then please mark your link up as NSFW/NSFL.

It's not goatse, but it is NSFW.

Not goatse, and I wouldn't consider it to be NSFW, but some folks might. Apologies for not marking it; I've missed the edit window.

Loads of cashback systems use it. You get directed to Lieferando or whatever and the "click" is registered using the referrer.

there are other ways to do the same, like a URL parameter. Referrer affects the privacy of everyone and the entire web. The fact that cashback systems for some small subset of internet users will be affected (and they have alternatives like URL parameters, they did not need to use referrer) is irrelevant.

We use them to prevent other websites to hotlink our dynamic map tiles. Not a big protection of course but useful anyway.

It was a somewhat common “security” feature to check referer, especially in the days before you could rely on CSP.

I recently had to enable it for some login to work, unfortunately can't remember which website.

I've had to enable it for Atlassian's login to work.

jwz has got a rather ... interesting use case for it relating to HN

And slashdot before that.

Ah jwz did this for /. too? If he did then it seems like he has switched it off, because I cannot reproduce it

I just tried to find references to it, but couldn’t. I’m wondering if my memory is broken. Slashdot is old though, we used to get worked up about bugs in X11 screensavers, and GNAA trollers.

Some sites use referrer as their "cookie session". One site use Cloudflare Anti-DDOS referrer as their cookie. Removing that referrer will cause the browser to infinity loop in CF Anti-DDOS because the site is expecting that referrer before entering the site.

I hate sharing Amazon shopping links because Amazon packs much referrer as possible in the link. Amazon uses the referrer to track who am I sharing to and use it for data for them to sells.

Are you conflating Referer with URL parameters? (Amazon calls them "ref tags" (referrer tags) but that's not HTTP Referer. It's not even possible to do what you are imagining with HTTP Referer, since Referer is only inside a browser session, not across from you to your friend.

Dang it, I didn't realize it was specific to HTTP. Thank you for pointing it out, all I see referrers (I somehow blank on HTTP) and I thought it was about the referrer tags.

Reply on news.ycombinator.com