It's time to abolish the HTTP referer

In times where we see that our privacy on the internet has to be protected more strongly, there's no place for the HTTP referer anymore.

Let's abolish this obsolete piece of the HTTP specification that was introduced in 1996 when tracking was not an issue.

* Websites want to know where we are visiting from? We shouldn't care.

* Websites want to use the referer for promotional purposes? We shouldn't care.

* Websites try to create statistics by using HTTP referer data? We shouldn't care.

Let's stop thinking about websites' intentions and protect ourselves.

> What is the state of Referer in modern browsers?

Referers are still sent in all popular browers and expose information that is not necessary at all.

> Why keep it?

I can't think of any reason. Can you?

> Would removing it break anything?

It might certainly break some websites. But mechanisms which rely on the HTTP referer are usually broken, anyway. It should not affect too many sites.

> File bugs against browser developers to remove Referer

The referer is such a fundamental feature (not due to its importance but history/habit) that a filed bug will probably be closed within minutes ;)

> Meanwhile users can disable Referer

Certainly. I have. But as with all security-related things, how many "normal" users will do this? 99% of users don't even know about "about:config" in Firefox etc.

> This becomes less of an issue as sites move to https, where Referer is not sent

This is wrong. Even on HTTPS, the referer is always sent unless the referenced site is plain (not secure) HTTP.

Worth considering Tor browser's stance on this (and a plethora of other issues). See A.1. Deprecation Wishlist

https://www.torproject.org/projects/torbrowser/design/

I happen to disagree with Tor on this though (they worry about breaking sites). I've found that setting referrer to target site's host has pretty good results (this can be done with various plugins).

In general, browser maintainers seem to prioritize compatibility over security. I think a new browser or fork that prioritizes security, possibly Tor, will eventually become dominant. And I'm excited for Servo, the renderer to replace Gecko, which is written in Rust (memory safe).

While the concern for user privacy is certainly understandable, abolishing the HTTP referer does not solve the issue. In fact it can be argued that it could do harm than good - basically every web based business relies on it in one way or another (customer acquisition channels, news mentions, backlinks, attribution, etc).

The referrer itself is not at all used in tracking the user - as the visitor data is usually aggregated by referring source. Fingerprinting and evercookies are much more common ways of tracking individual users, and you can bet that there are even more advanced methods available for government agencies with service-level access.

Exactly, there's no reason to keep the referer. But deprecation is necessary, so that the tons of websites that (wrongly) rely on the referer can adapt.