Hacker News Reader

That's definitely not to spec if the browser is doing it. http://tools.ietf.org/html/rfc2616#section-15.1.3

"Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol."

However, it's possible that Facebook is passing users through an HTTP gateway.

View on HN

It looks like the intermediate 301's referer is being passed thru (For example, all links on Twitter get wrapped as a t.co link, and that's what shows up on the server). I'd imagine that analytics being mined are intelligent enough to collapse twitter.com and t.co as the same social origin.

Give it a try yourself: https://twitter.com/vikrum5000/status/256898972478763008 Note the protocol.

Reply on news.ycombinator.com