Live data from Hacker News

How not to do URL redirects (… the way Quora does)

engineering.webengage.com

11–20 of 56 posts

Re: How not to do URL redirects (… the way Quora does)

#11
post #4

Earlier quoted context omitted.

So what should an app do if it wants ro track all outbound links and send the real url as referer to the outbound link

The best way to do it is probably to track clicks on outbound links using javascript.

Aren't there a few cases when this method won't work?

Re: How not to do URL redirects (… the way Quora does)

#14

Earlier quoted context omitted.

The best way to do it is probably to track clicks on outbound links using javascript.

Aren't there a few cases when this method won't work?

Are you referring to the fact that the browser will interrupt your tracking request because it already started loading the linked page? I haven't really tried, but I believe this can be dealt with if your server-side code expects it to happen.

Re: How not to do URL redirects (… the way Quora does)

#15
post #4

Earlier quoted context omitted.

Not sure if I understood this correctly. If Quora chose to send a Location: some-url and Status: 302, it would have definitely worked as expected.

So what should an app do if it wants ro track all outbound links and send the real url as referer to the outbound link

Upgrade the links with jQuery. Here's a simplified version of what I use:

    $("a").bind("mousedown", function(e) { 
        $(this).data("href", $(this).attr("href"));
        $(this).attr("href","http://example.com/redirect?url=" + $(this).attr("href"));
    });
    $("a").bind("mouseup",function(e) {
        var el = $(this);
        setTimeout(function() {
            el.attr("href", el.data("href"));
        },10);
    });

This works by switching the url when a user clicks a link to your redirect url, then switching it back a fraction of a second after they mouse up. This means that your redirect works even if the user right clicks and opens in a new window / tab and when a user hovers over a link, they still see the normal URL in the status bar.

On the /redirect url just log any data you need and send a 301 or 302 redirect. The destination site will see your original page as a referrer, not your redirect url.

Re: How not to do URL redirects (… the way Quora does)

#16
post #4

Earlier quoted context omitted.

Not sure if I understood this correctly. If Quora chose to send a Location: some-url and Status: 302, it would have definitely worked as expected.

So what should an app do if it wants ro track all outbound links and send the real url as referer to the outbound link

When a user submits a link and before inserting it into HTML, URL encode it and append it to a generic redirector, such as

www.example.com/redirect?url=http%3A%2F%2Fwww.example.net

www.example.com/redirect should record url and return 302 with Location set to www.example.net.

Re: How not to do URL redirects (… the way Quora does)

#17

I don't see how this could be a result of simple mistake. There doesn't seem to be any reason to do redirects this way except hiding the referrer.

Exactly what is pointed out in the post. Why would someone want to hide the original referrer for a link.

That's not the only thing they're doing...

http://nerdr.com/quora-needs-to-die/

Seems they're going down the annoying search visitors by hiding information route (similar to what expertsexchange was riled on for, although not quite as bad yet).

Re: How not to do URL redirects (… the way Quora does)

#18
post #15
post #4

Earlier quoted context omitted.

So what should an app do if it wants ro track all outbound links and send the real url as referer to the outbound link

Upgrade the links with jQuery. Here's a simplified version of what I use: $("a").bind("mousedown", function(e) { $(this).data("href", $(this).attr("href")); $(this).attr("href","http://example.com/redirect?url=" + $(this).attr("href")); }); $("a").bind("mouseup",function(e) { var el = $(this); setTimeout(function() { el.attr("href", el.data("href")); },10); }); This works by switching the url when a user clicks a lin…

It doesn't work for keyboard access in the sense that you don't insert the redirect, but at least the link still takes them to the right place.

Seems like the original link following the `url=` should be processed by encodeURIComponent or else any original urls with chars like ""&" will break.

Re: How not to do URL redirects (… the way Quora does)

#19
This is probably not the case, but is it possible that Quora is intentionally stripping the referer header? Duck Duck Go does just this in the interest of user privacy: why should site X know where I came from and what I was searching? https://duckduckgo.com/privacy.html Seems unlikely in this case but possible.

Incidentally, it seems that encrypted.google.com does this but not regular google. EDIT: This happens for all https->http requests, it's not a google feature (TIL).

Re: How not to do URL redirects (… the way Quora does)

#20
post #19

This is probably not the case, but is it possible that Quora is intentionally stripping the referer header? Duck Duck Go does just this in the interest of user privacy: why should site X know where I came from and what I was searching? https://duckduckgo.com/privacy.html Seems unlikely in this case but possible. Incidentally, it seems that encrypted.google.com does this but not regular google. EDIT: This happens for…

encrypted.google.com does this because it uses https. If a website is accessed from https and a link points to anywhere except another secure location, then the referrer is not sent.
Post reply on HN