News for hackers. Stuff that matters.

A comment on Firefox 59 to strip path information from referrer values for 3rd parties.

Re:Firefox 59 to strip path information from referrer values... by x775 on Thursday February 01, 2018 @05:24PM (#16286500)
In about:config, setting 'network.http.sendRefererHeader' to 0 (default is 2) will stop the referer header from being sent, and the document.referrer from being set. See http://kb.mozillazine.org/Network.http.sendRefererHeader for more information.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by randomString1 on Thursday February 01, 2018 @05:31PM (#16286579)
There are several referer settings.

https://raw.githubusercontent.com/pyllyukko/user.js/master/u...

user_pref("network.http.referer.userControlPolicy", x);

// TODO: https://github.com/pyllyukko/user.js/issues/94, commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs

user_pref("network.http.referer.spoofSource", x);

user_pref("network.http.referer.XOriginPolicy", x);

[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by x775 on Thursday February 01, 2018 @05:38PM (#16286627)
That is a very informative source, thank you!
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by LukeShu on Thursday February 01, 2018 @06:44PM (#16287039)
That page is quite outdated (2007), a better reference for about:config referrer options is https://wiki.mozilla.org/Security/Referrer (which is linked to at the bottom of the blog post about FF59 being discussed).

It seems that Firefox 59 will effectively force about:config's network.http.referer.XOriginTrimmingPolicy to 2 (default is 0) when in private browsing.

[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by open-source-ux on Thursday February 01, 2018 @05:27PM (#16286542)
Disabling the referrer header completely can prevent you from signing into some sites unfortunately. Another option in Firefox is to use network.http.referer.spoofSource.

In the URL bar, type:

about:config

Search for the following setting:

network.http.referer.spoofSource

Double-click to set its value to true. This basically sends the destination or target URL as the referrer.

[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by x775 on Thursday February 01, 2018 @05:39PM (#16286631)
I have not had issues thus far signing in on sites, though that might just have been dumb luck. I appreciate the heads-up and the additional information, thanks!
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by dylanpyle on Thursday February 01, 2018 @07:48PM (#16287386)
Similar for Chrome, there's a flag at chrome://flags/#reduced-referrer-granularity

Description: "If a page hasn't set an explicit referrer policy, setting this flag will reduce the amount of information in the 'referer' header for cross-origin requests."

[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by yborg on Thursday February 01, 2018 @05:44PM (#16286680)
https://github.com/meh/smart-referer

Configurable referer behavior, including whitelist.

[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by Momquist on Thursday February 01, 2018 @06:47PM (#16287054)
uMatrix also has a similar feature, among many others (request blocking by type, cookie and cache management, etc...)

https://github.com/gorhill/uMatrix

[ Parent | on HN ]