17

In theory browsers do not pass on referer information from HTTPS to HTTP sites. And in my experience this has always been true. But I just found an exception, and I want to understand why it works so I can use it as well.

Search for "what is my referer" on https://www.google.ca/
eg: https://www.google.ca/search?q=what+is+my+referer

There are a few sites that will show referer. They all seem to "work" when they shouldn't. For example, click the www.whatismyreferer.com one. I get:

 Your referer:
 https://www.google.ca/

Note that sometimes, rarely, I get "no referer" as the result. Go back and click the link again and it'll "work" the next time.

This should not happen. www.whatismyreferer.com is a non-HTTPS site. The referer header should not be being passed, but it is.

What's going on here, and how can I do the same from my HTTPS site to the HTTP sites I'm linking to?

4
  • 1
    I should note that I'm using Chrome on Windows, if that makes any difference (eg: if other people are seeing different results on different browsers / OSs)
    – ravisorg
    Jul 2, 2013 at 16:51
  • This behaviour is not true any more.
    – Flimm
    Mar 13, 2015 at 11:42
  • @ravisorg, Shouldn't this be posted on S/O instead?
    – Pacerier
    Apr 15, 2015 at 5:49
  • Google now returns an HTTPS link, so the test is no longer valid :-( Dec 24, 2018 at 21:26

5 Answers 5

23

Looks like it's due to a new <meta> header that Google is using:

 <meta name="referrer" content="origin">

Specification: https://w3c.github.io/webappsec-referrer-policy/

It's currently only fully supported by a few browsers, so it's not a complete solution, but certainly a start!

4

This is the standard behavior.

https://www.rfc-editor.org/rfc/rfc2616#section-15.1.3 says

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.

so if your client is doing that, it is violating the standard.

then again, google IS the standard, and they can do whatever they want :-)

4
  • 1
    "Should" means optional right?
    – Pacerier
    May 14, 2014 at 13:05
  • yeah, i would think so, optional.
    – johnshen64
    May 21, 2014 at 12:14
  • 4
    Since it's optional, Why do you say that it is violating the standard?
    – Pacerier
    Dec 25, 2014 at 20:09
  • 1
    By now 2616 is obsolete. 7231 Section 5.5.2 says "A user agent MUST NOT send a Referer header field in an unsecured HTTP request if the referring page was received with a secure protocol." It does not specify what agents are supposed to do for secured HTTP requests though.
    – Peter
    Jul 7, 2017 at 15:20
1

This appears to be something that the javascript on the google page is doing. I don't see it in firefox with noscript enabled and stop seeing it in Chrome on Windows if I disable javascript. I don't know what specifically as I haven't dug any deeper than that.

3
  • Nope, it's not javascript related (I thought of that and checked it out before asking). Looks like it's a new <meta> tag that Chrome is following.
    – ravisorg
    Jul 2, 2013 at 18:17
  • Disabling javascript reliably prevents the referrer from working here. I don't know. Maybe more than one thing is involved here. Jul 2, 2013 at 20:05
  • That's very interesting - I'm going to experiment more with that. Thanks for the feedback!
    – ravisorg
    Jul 2, 2013 at 20:57
0

<meta> Label's attribute name has new referrer rules, Referrer controlling the content of the HTTP Referer HTTP header attached to any request sent from this document.

For more information please check here: RFC Referrer Policy

1
  • This is the same as the already accepted answer?!
    – DocRoot
    May 19, 2017 at 21:05
-2

It is because when you click on the link, you are redirected from https://www.google.... to http://www.google... then you are redirected to www.whatismyreferer.com

And like you said, between http website the referer is transmitted.

You can check that with a Firefox extension

3
  • 2
    Are you guessing, or are you basing that on fact? Because I don't see that happening on my end. Clicking the link sends you to an HTTPS redirect on google.ca and then on to the end domain. I never hit a non-https URL until I reach (eg) www.whatismyreferer.com. Also note the referer specifically states httpS://www.google.ca, not http.
    – ravisorg
    Jul 2, 2013 at 16:51
  • Yeah, this answer appears to be incorrect.
    – ceejayoz
    Jul 2, 2013 at 17:04
  • Here is the dump of the http headers : pastebin.com/Y1HJyJ87 I just stripped resources download (like google suggest & other ajax stuff) and cookies related datas. But I have to admit that when I tried multiple times, google behaved differently... Sometimes using only https, therefore not allowing the website to show me my referer. Just try by yourself Jul 2, 2013 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .