We let you create surveys and display those on your website in a “targeted” manner
A better title for your article would have been:
why to never rely on referers
(which can be blocked or purposely malformed)
How not to do URL redirects (… the way Quora does)
31–40 of 56 posts
Re: How not to do URL redirects (… the way Quora does)
#32We let you create surveys and display those on your website in a “targeted” manner A better title for your article would have been: why to never rely on referers (which can be blocked or purposely malformed)
Absolutely! The post might have got some attention from Quora in that case :)
Re: How not to do URL redirects (… the way Quora does)
#33I hate to crash the party, but why is the premise that "overriding links is absolutely okay" taken for granted? Says who? Google and their `/url`? Facebook and their `l.php`?
Why wouldn't it be okay? This is a link on their own website, they can control it how they want.
Re: How not to do URL redirects (… the way Quora does)
#34I hate to crash the party, but why is the premise that "overriding links is absolutely okay" taken for granted? Says who? Google and their `/url`? Facebook and their `l.php`?
Why wouldn't it be okay? This is a link on their own website, they can control it how they want.
That's the point. It is okay as long as they play nice with HTTP headers and other info which needs to be passed downstream.
Re: How not to do URL redirects (… the way Quora does)
#35I hate to crash the party, but why is the premise that "overriding links is absolutely okay" taken for granted? Says who? Google and their `/url`? Facebook and their `l.php`?
Indeed, referers are useful information in some cases. For bookmarking apps like http://noteplz.com one useful thing is that along with the bookmark, they also store the referer, so you can later go back to the google search result where you found that bookmark.
On the other hand, with https and url shorteners,referers are a dying breed. The situation with URL shorteners is absurdly funny now, because twitter double-shortens the shortened urls, since most popular sites have their own shortener.
Re: How not to do URL redirects (… the way Quora does)
#36It's most likely done intentionally to protect against leaking the clicker's identity. See the issue Facebook had back then: http://www.benedelman.org/news/052010-1.html
Sending an incorrect site referrer to a downstream website doesn't solve the identity problem! HTTP headers have existed even before all these applications came into being. One just has to abide by some of those basics.
It can be fixed through a double redirect. Basically, redirect the browser to a internal page that redirects to the original page and have that page redirect to the outbound link.
For example:
Say you're on this page: http://site.com/article?_uid=123 (_uid being the identity leaking query param) and clicked a link that appears to point to: http://google.com/
When a user clicks on that link, the page redirect the user to http://site.com/redirect?target=http%3A%2F%2Fgoogle.com&...
The server will then redirect the browser back to: http://site.com/article
And when the server sees that request with referrer set to /redirect?target=http%3A%2F%2Fgoogle.com, it will then parse out the target url and redirect the browser to http://google.com.
This way, the target url can be given a meaningful referrer url without compromising user's identity.
Re: How not to do URL redirects (… the way Quora does)
#37Has anyone asked on Quora, why Quora does this?
Someone finally asked the question on Quora - http://www.quora.com/Why-does-Quora-redirect-to-URLs-in-a-wa...
Re: How not to do URL redirects (… the way Quora does)
#38Earlier quoted context omitted.
Tracking helps you build great analytics. I, as a developer, would have otherwise no idea of what's happening in my app.
Do it client-side. Don't break the web.
Doing it client side has a couple issues.
1. you need to block the click event until you get a response from your analytics endpoint. Google suggests doing this by adding a 100ms delay: http://support.google.com/googleanalytics/bin/answer.py?hl=e...
2. you might get holes in your data for a number of reasons: the user has JS turned off; 100ms isn't long enough for the request to go through; or the user might click off before your script can attach itself to the onclick event.
You definitely don't want to get yourself in a situation where you go down and all outbound links stop working, but if you can fail gracefully, replacing the link makes a lot more sense.
Re: How not to do URL redirects (… the way Quora does)
#39Earlier quoted context omitted.
Why wouldn't it be okay? This is a link on their own website, they can control it how they want.
That's the point. It is okay as long as they play nice with HTTP headers and other info which needs to be passed downstream.
Quora don't "need" to do anything. You just want them to.
Re: How not to do URL redirects (… the way Quora does)
#40Best I can tell, there is zero incentive for Quora (or any other site, for that matter) to care. Their current redirect logic in no way hurts their user experience.
Right now they protect their users' privacy. What benefit do they realize by providing their users' viewing history to other sites?
I personally think that the referer header was never a good idea. I disable it in my browser, and appreciate sites that do right by their users with privacy protecting default behaviors.