Create an anonymous link that will hide the HTTP Referer header

Re:Create an anonymous link that will hide the HTTP Referer ... by londons_explore on Tuesday April 13, 2021 @10:45AM (#26792879)

HTTPS doesn't give referrers anyway...

Most of the web is HTTPS now, so why does this matter?

[ Parent | on HN ]

Re:Create an anonymous link that will hide the HTTP Referer ... by vince14 on Tuesday April 13, 2021 @10:54AM (#26793010)

The destination site still receives the referrer header, sent by your browser via HTTPS. Further measures are needed like this one.

[ Parent | on HN ]

Re:Create an anonymous link that will hide the HTTP Referer ... by londons_explore on Tuesday April 13, 2021 @12:32PM (#26794921)

You're mistaken. MdN says:

strict-origin-when-cross-origin (default) Send the origin, path, and querystring when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS).

So no path is sent to the destination of a link over https - only the domain.

[ Parent | on HN ]

Re:Create an anonymous link that will hide the HTTP Referer ... by vince14 on Tuesday April 13, 2021 @02:29PM (#26796846)

You left out the part which contradicts your claim.

> Don't send the Referer header to less secure destinations (HTTPS→HTTP).

The referer header is still sent from HTTPS to HTTPS.

[ Parent | on HN ]

Re:Create an anonymous link that will hide the HTTP Referer ... by londons_explore on Wednesday April 14, 2021 @01:54AM (#26803414)

Yes, but only with the domain not the full path. Does anyone really care that the domain is leaked? There are very few secret domains...

[ Parent | on HN ]