News for hackers. Stuff that matters.

A comment on Firefox 59 to strip path information from referrer values for 3rd parties. Parent comment

Re:Firefox 59 to strip path information from referrer values... by koolba on Thursday February 01, 2018 @05:35PM (#16286605)
That would continue to work fine with a default same origin allowance. A separate domain would require a referral policy.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by pawelk on Thursday February 01, 2018 @06:06PM (#16286815)
Origin policy is a client thing. Referrer is accessible to the server. It's like using robots.txt vs. HTTP Auth to protect your content.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by nothrabannosir on Thursday February 01, 2018 @08:09PM (#16287518)
Referrer is also a client thing. Referrer based hotlink protection implicitly trusts the visitors' UAs. Same for Origin; it just offloads the actual check to the visitor. No big difference.

HTTP Auth, on the other hand, is actual password protection which cannot be spoofed by a malicious client. Very different from robots.txt.

[ Parent | on HN ]