Create an anonymous link that will hide the HTTP Referer header | Hacker News Reader

Create an anonymous link that will hide the HTTP Referer header

href.li

19 pointsmodinfo19 comments

This is so dangerous to use. There have been hundrets of these sites in the past. As soon as they have enough traffic they silently redirect or change affiliate ids etc. Do not use them, the rel=noreferer is good enough.

I thought its rel=noreferrer

that's what MDN has

It shows both: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...

Huh. Thanks, I was just looking there yesterday and I'm sure I didn't see the other option. I gotta check my history, see if I'm losing my mind.

Shared as URL, will not use <A> tag for the redirect, but "<meta>" tag, which isn't that well supported.

Share people’s Referer, destination, and control over their destination with a random third party that may or may not be around in the future :)

It uses "<meta name="referrer" content="no-referrer" />".

Not all browsers will respect that.

I'm not aware of any browser since IE10, and some versions of IE11, that don't. https://caniuse.com/rel-noreferrer

That's for the link element, this is for meta https://caniuse.com/mdn-html_elements_meta_name_referrer

Though it's not entirely in the spirit of the HN guidelines, I find it reasonble to flag dangerous content. I've done so for this post, and I would advise onlookers to do the same.

Kudos for the name, but this isn't the first service to provide this.

Brilliant idea!

No, just dangerous for your users.

HTTPS doesn't give referrers anyway...

Most of the web is HTTPS now, so why does this matter?

The destination site still receives the referrer header, sent by your browser via HTTPS. Further measures are needed like this one.

You're mistaken. MdN says:

strict-origin-when-cross-origin (default) Send the origin, path, and querystring when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS).

So no path is sent to the destination of a link over https - only the domain.

You left out the part which contradicts your claim.

> Don't send the Referer header to less secure destinations (HTTPS→HTTP).

The referer header is still sent from HTTPS to HTTPS.

Yes, but only with the domain not the full path. Does anyone really care that the domain is leaked? There are very few secret domains...

Reply on news.ycombinator.com