Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In theory browsers do not pass on referer information from HTTPS to HTTP sites. And in my experience this has always been true. But I just found an exception, and I want to understand why it works so I can use it as well.

Search for "what is my referer" on https://www.google.ca/
eg: https://www.google.ca/search?q=what+is+my+referer

There are a few sites that will show referer. They all seem to "work" when they shouldn't. For example, click the www.whatismyreferer.com one. I get:

 Your referer:
 https://www.google.ca/

Note that sometimes, rarely, I get "no referer" as the result. Go back and click the link again and it'll "work" the next time.

This should not happen. www.whatismyreferer.com is a non-HTTPS site. The referer header should not be being passed, but it is.

What's going on here, and how can I do the same from my HTTPS site to the HTTP sites I'm linking to?

share|improve this question
1  
I should note that I'm using Chrome on Windows, if that makes any difference (eg: if other people are seeing different results on different browsers / OSs) –  ravisorg Jul 2 '13 at 16:51

4 Answers 4

up vote 5 down vote accepted

Looks like it's due to a new <meta> header that Google is using:

 <meta name="referrer" content="origin">

Specification: http://wiki.whatwg.org/wiki/Meta_referrer

Only supported by webkit at the moment, with Firefox support on the way.

So not a complete solution, but certainly a start!

share|improve this answer

This appears to be something that the javascript on the google page is doing. I don't see it in firefox with noscript enabled and stop seeing it in Chrome on Windows if I disable javascript. I don't know what specifically as I haven't dug any deeper than that.

share|improve this answer
    
Nope, it's not javascript related (I thought of that and checked it out before asking). Looks like it's a new <meta> tag that Chrome is following. –  ravisorg Jul 2 '13 at 18:17
    
Disabling javascript reliably prevents the referrer from working here. I don't know. Maybe more than one thing is involved here. –  Etan Reisner Jul 2 '13 at 20:05
    
That's very interesting - I'm going to experiment more with that. Thanks for the feedback! –  ravisorg Jul 2 '13 at 20:57

This is the standard behavior.

https://tools.ietf.org/html/rfc2616#section-15.1.3 says

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.

so if your client is doing that, it is violating the standard.

then again, google IS the standard, and they can do whatever they want :-)

share|improve this answer
    
"Should" means optional right? –  Pacerier May 14 at 13:05
    
yeah, i would think so, optional. –  johnshen64 May 21 at 12:14
    
Then it isn't violating the RFC is it? –  Pacerier May 22 at 10:36

It is because when you click on the link, you are redirected from https://www.google.... to http://www.google... then you are redirected to www.whatismyreferer.com

And like you said, between http website the referer is transmitted.

You can check that with a Firefox extension

share|improve this answer
2  
Are you guessing, or are you basing that on fact? Because I don't see that happening on my end. Clicking the link sends you to an HTTPS redirect on google.ca and then on to the end domain. I never hit a non-https URL until I reach (eg) www.whatismyreferer.com. Also note the referer specifically states httpS://www.google.ca, not http. –  ravisorg Jul 2 '13 at 16:51
    
Yeah, this answer appears to be incorrect. –  ceejayoz Jul 2 '13 at 17:04
    
Here is the dump of the http headers : pastebin.com/Y1HJyJ87 I just stripped resources download (like google suggest & other ajax stuff) and cookies related datas. But I have to admit that when I tried multiple times, google behaved differently... Sometimes using only https, therefore not allowing the website to show me my referer. Just try by yourself –  user2299634 Jul 2 '13 at 18:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.