Preventing CSRF attacks: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(...

This. For this you just need the origin though. There's an origin header for 10 years which makes CSRF protection so trivial yet its still not available in all browsers. Firefox can leak referer in regular mode but can't send origin? Not sure.

Anyone knows a good document on when/which browser actually sends referer header?

Firefox and Edge don't send Origin headers with POST requests[0] while all send Referer.[1]

0: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or...

1: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...

If you have a giant traffic spike, it's nice to know where it came from. Eg. if you get linked on Hacker News, you can go to the thread and engage with potential customers.

Weird, every time I get HN traffic the referrer is the HN homepage, never individual posts. Is it just me?

I guess that's because people click on the link while it's on the frontpage, not from the post's comments section.

Of course, but that's from the point of view of site owners. Browsers are owned by their users.

That's not really a direct reason for the client to send them though. There are tons of useful things about referrers to the host.

Stripping everything but the domain should be mostly ok for the client though, so if I come from a.b.com/foo, it just sends b.com as referrer? Both "a" and "foo" can hold any amount of data so those would have to go. Sending b.com should be enough to provide traffic statistics?

Referral headers can be very useful for tracking down fraud and phishing activities.

Although tracking down fraud is usually as it relates fraudulent traffic which mostly effects advertising so I imagine a lot of the commenters here would say that is not a good reason.

Sites can outright disable referrers using a meta tag: https://www.w3.org/TR/referrer-policy/#referrer-policy-no-re...

They are useful to prevent the hotlinking of images/video from third party domains, which can incur in significant bandwidth costs for smaller websites.

That would continue to work fine with a default same origin allowance. A separate domain would require a referral policy.

Origin policy is a client thing. Referrer is accessible to the server. It's like using robots.txt vs. HTTP Auth to protect your content.

Referrer is also a client thing. Referrer based hotlink protection implicitly trusts the visitors' UAs. Same for Origin; it just offloads the actual check to the visitor. No big difference.

HTTP Auth, on the other hand, is actual password protection which cannot be spoofed by a malicious client. Very different from robots.txt.

This is just like traffic statistics - a help to the host, not the client. This is data sent voluntarily by the client so there has to be some direct benefit to the client in sending it, or at least sending any more than the domain name with out path, subdomain and parameters?

Also paywall skipping, to track what sites are bringing you traffic, to pass fields to forms to report problems, to present targeted traffic based on use, and of course, advertising.

The question was for reasons to __not__ remove them.

And those are all answers...?

How are those answers supposed to convince me to keep the referer setting in my browser on? In fact, they're even more likely to convince me to turn it off.

They want to know reasons why a user would want to keep the referrer, not the asshole that is tracking them.

I was wondering the same thing.