News for hackers. Stuff that matters.
Re:Sites using Facebook ‘Like’ button liable for data, EU co... by daxterspeed on Sunday August 04, 2019 @04:23PM (#20609013)
Well if the referrer header matches the shared url it's just bloat in the request headers, and if it doesn't it's possibly leaking details it shouldn't, like perhaps a token in a query parameter. Twitter, Facebook, etc doesn't really need to know where a user initiated a share anyway.

Either way making sure that window.opener isn't available to random sites is a critical security feature and in some browsers that require you to set noreferrer, so better safe than sorry.

There are no comments on this comment yet.