Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to do URL redirects (… the way Quora does)

engineering.webengage.com

Post reply on HN
Print view View original

21–30 of 56 posts

Re: How not to do URL redirects (… the way Quora does)

#21

Post by jimktrains2 »

sequoia wrote: post #19

This is probably not the case, but is it possible that Quora is intentionally stripping the referer header? Duck Duck Go does just this in the interest of user privacy: why should site X know where I came from and what I was searching? https://duckduckgo.com/privacy.html Seems unlikely in this case but possible. Incidentally, it seems that encrypted.google.com does this but not regular google. EDIT: This happens for…

The User-Agent generates the Referrer header, not the site. Also, encrypted.google.com doesn't do it, the HTTPS standard says that browsers shouldn't send referrer headers to sites not in the same domain or not with https.

Re: How not to do URL redirects (… the way Quora does)

#23

Post by Sidnicious »

gecco wrote: post #4
avlesh-singh wrote: post #3

Earlier quoted context omitted.

Not sure if I understood this correctly. If Quora chose to send a Location: some-url and Status: 302, it would have definitely worked as expected.

So what should an app do if it wants ro track all outbound links and send the real url as referer to the outbound link

Can’t you track it (on the server) on the page that sends the 302 response?

Another option would be to link to the real URL, and make a synchronous XHR from JavaScript (to your server) when the link is clicked.

Re: How not to do URL redirects (… the way Quora does)

#24

Post by avlesh-singh »

yuvadam wrote: post #22

I hate to crash the party, but why is the premise that "overriding links is absolutely okay" taken for granted? Says who? Google and their `/url`? Facebook and their `l.php`?

Tracking helps you build great analytics. I, as a developer, would have otherwise no idea of what's happening in my app.

Re: How not to do URL redirects (… the way Quora does)

#25

Post by MatthewPhillips »

avlesh-singh wrote: post #24
yuvadam wrote: post #22

I hate to crash the party, but why is the premise that "overriding links is absolutely okay" taken for granted? Says who? Google and their `/url`? Facebook and their `l.php`?

Tracking helps you build great analytics. I, as a developer, would have otherwise no idea of what's happening in my app.

Do it client-side. Don't break the web.

Re: How not to do URL redirects (… the way Quora does)

#26

Post by sequoia »

jimktrains2 wrote: post #21
sequoia wrote: post #19

This is probably not the case, but is it possible that Quora is intentionally stripping the referer header? Duck Duck Go does just this in the interest of user privacy: why should site X know where I came from and what I was searching? https://duckduckgo.com/privacy.html Seems unlikely in this case but possible. Incidentally, it seems that encrypted.google.com does this but not regular google. EDIT: This happens for…

The User-Agent generates the Referrer header, not the site. Also, encrypted.google.com doesn't do it, the HTTPS standard says that browsers shouldn't send referrer headers to sites not in the same domain or not with https.

You are right, I'm writing carelessly. I meant strip loosely as "causes the header to not be sent" or not in full.

Re: How not to do URL redirects (… the way Quora does)

#30

Post by avlesh-singh »

buddydvd wrote: post #29

It's most likely done intentionally to protect against leaking the clicker's identity. See the issue Facebook had back then: http://www.benedelman.org/news/052010-1.html

Sending an incorrect site referrer to a downstream website doesn't solve the identity problem! HTTP headers have existed even before all these applications came into being. One just has to abide by some of those basics.
Post reply on HN