17

In theory browsers do not pass on referer information from HTTPS to HTTP sites. And in my experience this has always been true. But I just found an exception, and I want to understand why it works so I can use it as well.

Search for "what is my referer" on https://www.google.ca/
eg: https://www.google.ca/search?q=what+is+my+referer

There are a few sites that will show referer. They all seem to "work" when they shouldn't. For example, click the www.whatismyreferer.com one. I get:

 Your referer:
 https://www.google.ca/

Note that sometimes, rarely, I get "no referer" as the result. Go back and click the link again and it'll "work" the next time.

This should not happen. www.whatismyreferer.com is a non-HTTPS site. The referer header should not be being passed, but it is.

What's going on here, and how can I do the same from my HTTPS site to the HTTP sites I'm linking to?

4
  • 1
    I should note that I'm using Chrome on Windows, if that makes any difference (eg: if other people are seeing different results on different browsers / OSs)
    – ravisorg
    Jul 2, 2013 at 16:51
  • This behaviour is not true any more.
    – Flimm
    Mar 13, 2015 at 11:42
  • @ravisorg, Shouldn't this be posted on S/O instead?
    – Pacerier
    Apr 15, 2015 at 5:49
  • Google now returns an HTTPS link, so the test is no longer valid :-( Dec 24, 2018 at 21:26

5 Answers 5

23

Looks like it's due to a new <meta> header that Google is using:

 <meta name="referrer" content="origin">

Specification: https://w3c.github.io/webappsec-referrer-policy/

It's currently only fully supported by a few browsers, so it's not a complete solution, but certainly a start!

4

This is the standard behavior.

https://www.rfc-editor.org/rfc/rfc2616#section-15.1.3 says

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.

so if your client is doing that, it is violating the standard.

then again, google IS the standard, and they can do whatever they want :-)

4
  • 1
    "Should" means optional right?
    – Pacerier
    May 14, 2014 at 13:05
  • yeah, i would think so, optional.
    – johnshen64
    May 21, 2014 at 12:14
  • 4
    Since it's optional, Why do you say that it is violating the standard?
    – Pacerier
    Dec 25, 2014 at 20:09
  • 1
    By now 2616 is obsolete. 7231 Section 5.5.2 says "A user agent MUST NOT send a Referer header field in an unsecured HTTP request if the referring page was received with a secure protocol." It does not specify what agents are supposed to do for secured HTTP requests though.
    – Peter
    Jul 7, 2017 at 15:20
1

This appears to be something that the javascript on the google page is doing. I don't see it in firefox with noscript enabled and stop seeing it in Chrome on Windows if I disable javascript. I don't know what specifically as I haven't dug any deeper than that.

3
  • Nope, it's not javascript related (I thought of that and checked it out before asking). Looks like it's a new <meta> tag that Chrome is following.
    – ravisorg
    Jul 2, 2013 at 18:17
  • Disabling javascript reliably prevents the referrer from working here. I don't know. Maybe more than one thing is involved here. Jul 2, 2013 at 20:05
  • That's very interesting - I'm going to experiment more with that. Thanks for the feedback!
    – ravisorg
    Jul 2, 2013 at 20:57
0

<meta> Label's attribute name has new referrer rules, Referrer controlling the content of the HTTP Referer HTTP header attached to any request sent from this document.

For more information please check here: RFC Referrer Policy

1
  • This is the same as the already accepted answer?!
    – DocRoot
    May 19, 2017 at 21:05
-2

It is because when you click on the link, you are redirected from https://www.google.... to http://www.google... then you are redirected to www.whatismyreferer.com

And like you said, between http website the referer is transmitted.

You can check that with a Firefox extension

3
  • 2
    Are you guessing, or are you basing that on fact? Because I don't see that happening on my end. Clicking the link sends you to an HTTPS redirect on google.ca and then on to the end domain. I never hit a non-https URL until I reach (eg) www.whatismyreferer.com. Also note the referer specifically states httpS://www.google.ca, not http.
    – ravisorg
    Jul 2, 2013 at 16:51
  • Yeah, this answer appears to be incorrect.
    – ceejayoz
    Jul 2, 2013 at 17:04
  • Here is the dump of the http headers : pastebin.com/Y1HJyJ87 I just stripped resources download (like google suggest & other ajax stuff) and cookies related datas. But I have to admit that when I tried multiple times, google behaved differently... Sometimes using only https, therefore not allowing the website to show me my referer. Just try by yourself Jul 2, 2013 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.