In theory browsers do not pass on referer information from HTTPS to HTTP sites. And in my experience this has always been true. But I just found an exception, and I want to understand why it works so I can use it as well.

Search for "what is my referer" on https://www.google.ca/
eg: https://www.google.ca/search?q=what+is+my+referer

There are a few sites that will show referer. They all seem to "work" when they shouldn't. For example, click the www.whatismyreferer.com one. I get:

 Your referer:

Note that sometimes, rarely, I get "no referer" as the result. Go back and click the link again and it'll "work" the next time.

This should not happen. www.whatismyreferer.com is a non-HTTPS site. The referer header should not be being passed, but it is.

What's going on here, and how can I do the same from my HTTPS site to the HTTP sites I'm linking to?

  • 1
    I should note that I'm using Chrome on Windows, if that makes any difference (eg: if other people are seeing different results on different browsers / OSs) – ravisorg Jul 2 '13 at 16:51
  • This behaviour is not true any more. – Flimm Mar 13 '15 at 11:42
  • @ravisorg, Shouldn't this be posted on S/O instead? – Pacerier Apr 15 '15 at 5:49
  • Google now returns an HTTPS link, so the test is no longer valid :-( – Silas S. Brown Dec 24 '18 at 21:26

Looks like it's due to a new <meta> header that Google is using:

 <meta name="referrer" content="origin">

Specification: https://w3c.github.io/webappsec-referrer-policy/

It's currently only fully supported by a few browsers, so it's not a complete solution, but certainly a start!


This is the standard behavior.

https://tools.ietf.org/html/rfc2616#section-15.1.3 says

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.

so if your client is doing that, it is violating the standard.

then again, google IS the standard, and they can do whatever they want :-)

  • 1
    "Should" means optional right? – Pacerier May 14 '14 at 13:05
  • yeah, i would think so, optional. – johnshen64 May 21 '14 at 12:14
  • 4
    Since it's optional, Why do you say that it is violating the standard? – Pacerier Dec 25 '14 at 20:09
  • 1
    By now 2616 is obsolete. 7231 Section 5.5.2 says "A user agent MUST NOT send a Referer header field in an unsecured HTTP request if the referring page was received with a secure protocol." It does not specify what agents are supposed to do for secured HTTP requests though. – Peter Jul 7 '17 at 15:20

This appears to be something that the javascript on the google page is doing. I don't see it in firefox with noscript enabled and stop seeing it in Chrome on Windows if I disable javascript. I don't know what specifically as I haven't dug any deeper than that.

  • Nope, it's not javascript related (I thought of that and checked it out before asking). Looks like it's a new <meta> tag that Chrome is following. – ravisorg Jul 2 '13 at 18:17
  • Disabling javascript reliably prevents the referrer from working here. I don't know. Maybe more than one thing is involved here. – Etan Reisner Jul 2 '13 at 20:05
  • That's very interesting - I'm going to experiment more with that. Thanks for the feedback! – ravisorg Jul 2 '13 at 20:57

<meta> Label's attribute name has new referrer rules, Referrer controlling the content of the HTTP Referer HTTP header attached to any request sent from this document.

For more information please check here: RFC Referrer Policy

  • This is the same as the already accepted answer?! – DocRoot May 19 '17 at 21:05

It is because when you click on the link, you are redirected from https://www.google.... to http://www.google... then you are redirected to www.whatismyreferer.com

And like you said, between http website the referer is transmitted.

You can check that with a Firefox extension

  • 2
    Are you guessing, or are you basing that on fact? Because I don't see that happening on my end. Clicking the link sends you to an HTTPS redirect on google.ca and then on to the end domain. I never hit a non-https URL until I reach (eg) www.whatismyreferer.com. Also note the referer specifically states httpS://www.google.ca, not http. – ravisorg Jul 2 '13 at 16:51
  • Yeah, this answer appears to be incorrect. – ceejayoz Jul 2 '13 at 17:04
  • Here is the dump of the http headers : pastebin.com/Y1HJyJ87 I just stripped resources download (like google suggest & other ajax stuff) and cookies related datas. But I have to admit that when I tried multiple times, google behaved differently... Sometimes using only https, therefore not allowing the website to show me my referer. Just try by yourself – user2299634 Jul 2 '13 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.