How not to do URL redirects (… the way Quora does) • Hacker News Board

Re: How not to do URL redirects (… the way Quora does)

#41

Post by avlesh-singh » Thu, Jan 19, 2012, 10:09 PM UTC

kogir wrote: post #40

Best I can tell, there is zero incentive for Quora (or any other site, for that matter) to care. Their current redirect logic in no way hurts their user experience. Right now they protect their users' privacy. What benefit do they realize by providing their users' viewing history to other sites? I personally think that the referer header was never a good idea. I disable it in my browser, and appreciate sites that do…

Of course there is zero incentive for anyone to do it. And if everyone chose to link the way Quora does, you get a Google Analytics dashboard which cannot tell you what all URL's are sending traffic to your site/blog. I find it really difficult to imagine.

Re: How not to do URL redirects (… the way Quora does)

#42

Post by drivebyacct2 » Thu, Jan 19, 2012, 10:11 PM UTC

mwhooker wrote: post #38

MatthewPhillips wrote: post #25

Earlier quoted context omitted.

Do it client-side. Don't break the web.

Doing it client side has a couple issues. 1. you need to block the click event until you get a response from your analytics endpoint. Google suggests doing this by adding a 100ms delay: http://support.google.com/googleanalytics/bin/answer.py?hl=e... 2. you might get holes in your data for a number of reasons: the user has JS turned off; 100ms isn't long enough for the request to go through; or the user might click of…

Why does the delay matter? They have to wait for a response regardless of whether it's an AJAX request or a full browser redirect to the record/redirect URL.

Re: How not to do URL redirects (… the way Quora does)

#43

Post by mnutt » Thu, Jan 19, 2012, 10:32 PM UTC

Since you are a hosted service, you could periodically loop through all of the Quora redirect links you've received and resolve them. This might be against Quora's TOS, though.

I believe Twitter does this with URL shortener links posted in tweets.

Re: How not to do URL redirects (… the way Quora does)

#44

Post by mkjones » Thu, Jan 19, 2012, 10:36 PM UTC

buddydvd wrote: post #36

avlesh-singh wrote: post #30

Earlier quoted context omitted.

Sending an incorrect site referrer to a downstream website doesn't solve the identity problem! HTTP headers have existed even before all these applications came into being. One just has to abide by some of those basics.

It can be fixed through a double redirect. Basically, redirect the browser to a internal page that redirects to the original page and have that page redirect to the outbound link. For example: Say you're on this page: http://site.com/article?_uid=123 (_uid being the identity leaking query param) and clicked a link that appears to point to: http://google.com/ When a user clicks on that link, the page redirect the user…

Isn't that exactly what Quora is doing?

Re: How not to do URL redirects (… the way Quora does)

#45

Post by mkjones » Thu, Jan 19, 2012, 10:37 PM UTC

zerostar07 wrote: post #35

yuvadam wrote: post #22

I hate to crash the party, but why is the premise that "overriding links is absolutely okay" taken for granted? Says who? Google and their `/url`? Facebook and their `l.php`?

Indeed, referers are useful information in some cases. For bookmarking apps like http://noteplz.com one useful thing is that along with the bookmark, they also store the referer, so you can later go back to the google search result where you found that bookmark. On the other hand, with https and url shorteners,referers are a dying breed. The situation with URL shorteners is absurdly funny now, because twitter double-…

I don't think url shorteners really hurt referrers at all. They typically use 301 or 302 redirects, which preserve the original referrer.

Re: How not to do URL redirects (… the way Quora does)

#46

Post by mkjones » Thu, Jan 19, 2012, 10:38 PM UTC

yuvadam wrote: post #22

I hate to crash the party, but why is the premise that "overriding links is absolutely okay" taken for granted? Says who? Google and their `/url`? Facebook and their `l.php`?

On sites where there's private information in the URLs + links to external sites, overriding the referrer is necessary in order to protect users' privacy / identity. See https://www.facebook.com/notes/facebook-engineering/protecti... for why we do this at Facebook (I work on that system).

Re: How not to do URL redirects (… the way Quora does)

#47

Post by lazerwalker » Thu, Jan 19, 2012, 10:44 PM UTC

mwhooker wrote: post #38

MatthewPhillips wrote: post #25

Earlier quoted context omitted.

Do it client-side. Don't break the web.

Doing it client side has a couple issues. 1. you need to block the click event until you get a response from your analytics endpoint. Google suggests doing this by adding a 100ms delay: http://support.google.com/googleanalytics/bin/answer.py?hl=e... 2. you might get holes in your data for a number of reasons: the user has JS turned off; 100ms isn't long enough for the request to go through; or the user might click of…

Not to mention that your analytics code won't fire if the user opens a link by any means other than a standard left-click (e.g. middle-click, right-click -> open in new window/tab, or keyboard navigation)

Re: How not to do URL redirects (… the way Quora does)

#48

Post by zerostar07 » Thu, Jan 19, 2012, 11:40 PM UTC

mkjones wrote: post #45

zerostar07 wrote: post #35

Earlier quoted context omitted.

Indeed, referers are useful information in some cases. For bookmarking apps like http://noteplz.com one useful thing is that along with the bookmark, they also store the referer, so you can later go back to the google search result where you found that bookmark. On the other hand, with https and url shorteners,referers are a dying breed. The situation with URL shorteners is absurdly funny now, because twitter double-…

I don't think url shorteners really hurt referrers at all. They typically use 301 or 302 redirects, which preserve the original referrer.

... however since twitter is under https, all of them end up being "t.co". And even if it wasn't https, a double redirect would lose the referrer

Re: How not to do URL redirects (… the way Quora does)

#49

Post by zerostar07 » Thu, Jan 19, 2012, 11:45 PM UTC

mkjones wrote: post #46

yuvadam wrote: post #22

I hate to crash the party, but why is the premise that "overriding links is absolutely okay" taken for granted? Says who? Google and their `/url`? Facebook and their `l.php`?

On sites where there's private information in the URLs + links to external sites, overriding the referrer is necessary in order to protect users' privacy / identity. See https://www.facebook.com/notes/facebook-engineering/protecti... for why we do this at Facebook (I work on that system).

Quora 's question pages are community-built public pages. If they have private urls in account pages, they should limit referral protection to them. Also, i wonder, doesn't the 200 OK code confuse search bots?

Re: How not to do URL redirects (… the way Quora does)

#50

Post by buddydvd » Thu, Jan 19, 2012, 11:49 PM UTC

mkjones wrote: post #44

buddydvd wrote: post #36

Earlier quoted context omitted.

It can be fixed through a double redirect. Basically, redirect the browser to a internal page that redirects to the original page and have that page redirect to the outbound link. For example: Say you're on this page: http://site.com/article?_uid=123 (_uid being the identity leaking query param) and clicked a link that appears to point to: http://google.com/ When a user clicks on that link, the page redirect the user…

Isn't that exactly what Quora is doing?

OP's blog post says Quora is not doing that. It says Quora's redirecting to gigaom.com from http://www.quora.com/_/redirect?url=http%3A%2F%2Fgigaom.com%... instead of http://www.quora.com/What-are-everyday-apps-that-use-cloud-c....

The technique I described allows Quora to customize the referrer associated with an outbound link.