Live data from Hacker News

Firefox 59 to strip path information from referrer values for 3rd parties

blog.mozilla.org

11–20 of 236 posts

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#12

> To help prevent third party data leakage while browsing privately , Firefox Private Browsing Mode will remove path information from referrers sent to third parties starting in Firefox 59. Emphasis mine. It only does it in private mode. I experimented with the referrer options mentioned in the article with mixed success. Not sending the referer header breaks some sites and often in a non-obvious way. EDIT: referrer…

Just curious, did it break any popular website?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#13
post #7

Are there any reasons not to get rid of referers altogether?

They are useful to prevent the hotlinking of images/video from third party domains, which can incur in significant bandwidth costs for smaller websites.

Also paywall skipping, to track what sites are bringing you traffic, to pass fields to forms to report problems, to present targeted traffic based on use, and of course, advertising.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#14
post #6

In about:config, setting 'network.http.sendRefererHeader' to 0 (default is 2) will stop the referer header from being sent, and the document.referrer from being set. See http://kb.mozillazine.org/Network.http.sendRefererHeader for more information.

There are several referer settings.

https://raw.githubusercontent.com/pyllyukko/user.js/master/u...

user_pref("network.http.referer.userControlPolicy", x);

// TODO: https://github.com/pyllyukko/user.js/issues/94, commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs

user_pref("network.http.referer.spoofSource", x);

user_pref("network.http.referer.XOriginPolicy", x);

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#15
post #7

Earlier quoted context omitted.

They are useful to prevent the hotlinking of images/video from third party domains, which can incur in significant bandwidth costs for smaller websites.

Also paywall skipping, to track what sites are bringing you traffic, to pass fields to forms to report problems, to present targeted traffic based on use, and of course, advertising.

The question was for reasons to __not__ remove them.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#16
post #7

Are there any reasons not to get rid of referers altogether?

They are useful to prevent the hotlinking of images/video from third party domains, which can incur in significant bandwidth costs for smaller websites.

That would continue to work fine with a default same origin allowance. A separate domain would require a referral policy.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#17
post #15

Earlier quoted context omitted.

Also paywall skipping, to track what sites are bringing you traffic, to pass fields to forms to report problems, to present targeted traffic based on use, and of course, advertising.

The question was for reasons to __not__ remove them.

[deleted]

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#18
post #6

In about:config, setting 'network.http.sendRefererHeader' to 0 (default is 2) will stop the referer header from being sent, and the document.referrer from being set. See http://kb.mozillazine.org/Network.http.sendRefererHeader for more information.

There are several referer settings. https://raw.githubusercontent.com/pyllyukko/user.js/master/u... user_pref("network.http.referer.userControlPolicy", x); // TODO: https://github.com/pyllyukko/user.js/issues/94 , commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs user_pref("network.http.referer.spoofSource", x); user_pref("network.http.referer.XOriginPolicy", x);

That is a very informative source, thank you!

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#19
post #6

In about:config, setting 'network.http.sendRefererHeader' to 0 (default is 2) will stop the referer header from being sent, and the document.referrer from being set. See http://kb.mozillazine.org/Network.http.sendRefererHeader for more information.

Disabling the referrer header completely can prevent you from signing into some sites unfortunately. Another option in Firefox is to use network.http.referer.spoofSource. In the URL bar, type: about:config Search for the following setting: network.http.referer.spoofSource Double-click to set its value to true. This basically sends the destination or target URL as the referrer.

I have not had issues thus far signing in on sites, though that might just have been dumb luck. I appreciate the heads-up and the additional information, thanks!
Post reply on HN