News for hackers. Stuff that matters.
Re:Using Cloudflare on your website could be blocking RSS users by bityard on Thursday October 17, 2024 @12:16PM (#41871044)
Lots of sites see an empty referrer and send you to their main page or marketing page. Which means you can't get anywhere else on their site without a valid referrer. They consider it a form of "hotlink" protection.

(I'm not saying I agree with it, just that it exists.)

Re:Using Cloudflare on your website could be blocking RSS users by zamadatix on Thursday October 17, 2024 @03:09PM (#41872789)
Sure but there are also better options if your goal was to keep those sites working. `Referrer-Policy: same-origin` will let all same origin referrals work but leak nothing cross origin. If you really really really want to only let the site you just loaded know you came from somewhere else on its domain but not particularly where for some reason then `Referrer-Policy: strict-origin` will do that for same origin requests and still drop the referrer completely cross origin. If you don't want any at all then `Referrer-Policy: no-referrer"` or just remove it. Any of these can be intercepted and set by a browser extension.

If you want to advertise the base origin of cross requests there's even an option for that. Where there isn't is a built in option is to just always forge the origin to the base of where you're connecting. My confusion is in what that extra work gained.