News for hackers. Stuff that matters.

A comment on Create an anonymous link that will hide the HTTP Referer header. Parent comment

Re:Create an anonymous link that will hide the HTTP Referer ... by vince14 on Tuesday April 13, 2021 @10:54AM (#26793010)
The destination site still receives the referrer header, sent by your browser via HTTPS. Further measures are needed like this one.
[ Parent | on HN ]
Re:Create an anonymous link that will hide the HTTP Referer ... by londons_explore on Tuesday April 13, 2021 @12:32PM (#26794921)
You're mistaken. MdN says:

strict-origin-when-cross-origin (default) Send the origin, path, and querystring when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS).

So no path is sent to the destination of a link over https - only the domain.

[ Parent | on HN ]
Re:Create an anonymous link that will hide the HTTP Referer ... by vince14 on Tuesday April 13, 2021 @02:29PM (#26796846)
You left out the part which contradicts your claim.

> Don't send the Referer header to less secure destinations (HTTPS→HTTP).

The referer header is still sent from HTTPS to HTTPS.

[ Parent | on HN ]
Re:Create an anonymous link that will hide the HTTP Referer ... by londons_explore on Wednesday April 14, 2021 @01:54AM (#26803414)
Yes, but only with the domain not the full path. Does anyone really care that the domain is leaked? There are very few secret domains...
[ Parent | on HN ]