Hacker News Reader

Comment by ComputerGuru | Hacker News Reader

I don't know about the spec, but in practice, you never get the referer data even when traffic flows from HTTPS to HTTPS.

View on HN

This is actually up to the client. In Firefox about:config, network.http.sendSecureXSiteReferrer is set to true by default, so it does send it, but you can turn it off.

Google decides what the referrer is since it redirects first to a url it controls (downgrading to http if necessary).

In practice, this is not true. As for spec [0]:

   Clients SHOULD NOT include a Referer header field in a (non-secure)
   HTTP request if the referring page was transferred with a secure
   protocol.

[0] http://tools.ietf.org/html/rfc2616#section-15.1.3

Unless I'm missing something, that section only addresses HTTPS -> HTTP referrals, not HTTPS -> HTTPS.

I don't know of such a section, there is simply a section on Referer[sic] request-headers [0], at large. HTTP -> HTTP and HTTPS -> HTTPS are implied, if the only stated consideration is HTTPS -> HTTP referrals. HTTPS -> HTTPS Referer works on Google Search, which is usually of the most concern.

[0] http://tools.ietf.org/html/rfc2616#section-14.36

Right. The article says this: "Additionally, using HTTPS helps providers like Google remove information from the referrer string."

Yes, just checked, they strip the keywords from the referrer when using https.

Reply on news.ycombinator.com