Hacker News Reader

Comment by mlinksva | Hacker News Reader

Will they not see the referer header if their own sites (as indexed by Google) are https?

If they don't switch, puts some sort of upper bound on how much they value the referer data.

(User agents aren't supposed to send referer http->https but scratch above if practice is for them not to send https->https across domains as well.)

View on HN

I don't know about the spec, but in practice, you never get the referer data even when traffic flows from HTTPS to HTTPS.

This is actually up to the client. In Firefox about:config, network.http.sendSecureXSiteReferrer is set to true by default, so it does send it, but you can turn it off.

Google decides what the referrer is since it redirects first to a url it controls (downgrading to http if necessary).

In practice, this is not true. As for spec [0]:

   Clients SHOULD NOT include a Referer header field in a (non-secure)
   HTTP request if the referring page was transferred with a secure
   protocol.

[0] http://tools.ietf.org/html/rfc2616#section-15.1.3

Unless I'm missing something, that section only addresses HTTPS -> HTTP referrals, not HTTPS -> HTTPS.

I don't know of such a section, there is simply a section on Referer[sic] request-headers [0], at large. HTTP -> HTTP and HTTPS -> HTTPS are implied, if the only stated consideration is HTTPS -> HTTP referrals. HTTPS -> HTTPS Referer works on Google Search, which is usually of the most concern.

[0] http://tools.ietf.org/html/rfc2616#section-14.36

Right. The article says this: "Additionally, using HTTPS helps providers like Google remove information from the referrer string."

Yes, just checked, they strip the keywords from the referrer when using https.

Reply on news.ycombinator.com