How not to do URL redirects (… the way Quora does) • Hacker News Board

Re: How not to do URL redirects (… the way Quora does)

#51

Post by mkjones » Fri, Jan 20, 2012, 12:29 AM UTC

buddydvd wrote: post #50

mkjones wrote: post #44

Earlier quoted context omitted.

Isn't that exactly what Quora is doing?

OP's blog post says Quora is not doing that. It says Quora's redirecting to gigaom.com from http://www.quora.com/_/redirect?url=http%3A%2F%2Fgigaom.com%... instead of http://www.quora.com/What-are-everyday-apps-that-use-cloud-c... . The technique I described allows Quora to customize the referrer associated with an outbound link.

Ah yes, I misread your post. The trouble with that approach is that you have to enumerate the dangerous params, and if the actual page URL needs a private parameter to work, you can't get rid of it.

Re: How not to do URL redirects (… the way Quora does)

#52

Post by marquis » Fri, Jan 20, 2012, 12:46 AM UTC

kogir wrote: post #40

Best I can tell, there is zero incentive for Quora (or any other site, for that matter) to care. Their current redirect logic in no way hurts their user experience. Right now they protect their users' privacy. What benefit do they realize by providing their users' viewing history to other sites? I personally think that the referer header was never a good idea. I disable it in my browser, and appreciate sites that do…

I think that is does benefit Quora for content providers to see how much traffic is being generated from their site. If I knew an article was getting a lot of traction on a site I would spend more time on there, perhaps participate and continue to improve and generate content itself, thus benefiting Quora with more data and more links for everyone.

Re: How not to do URL redirects (… the way Quora does)

#53

Post by buddydvd » Fri, Jan 20, 2012, 5:15 AM UTC

mkjones wrote: post #51

buddydvd wrote: post #50

Earlier quoted context omitted.

OP's blog post says Quora is not doing that. It says Quora's redirecting to gigaom.com from http://www.quora.com/_/redirect?url=http%3A%2F%2Fgigaom.com%... instead of http://www.quora.com/What-are-everyday-apps-that-use-cloud-c... . The technique I described allows Quora to customize the referrer associated with an outbound link.

Ah yes, I misread your post. The trouble with that approach is that you have to enumerate the dangerous params, and if the actual page URL needs a private parameter to work, you can't get rid of it.

Right, but you can always pass the canonical url to the redirector. That lets you avoid maintaining a whitelist/blacklist of query params. This should be trivial for Quora as most of their pages already contain the meta tag specifying the canonical url:

They just need to update their outbound link interceptor to take that version instead of the actual url.

Re: How not to do URL redirects (… the way Quora does)

#54

Post by buddydvd » Fri, Jan 20, 2012, 6:04 AM UTC

gecco wrote: post #4

avlesh-singh wrote: post #3

Earlier quoted context omitted.

Not sure if I understood this correctly. If Quora chose to send a Location: some-url and Status: 302, it would have definitely worked as expected.

So what should an app do if it wants ro track all outbound links and send the real url as referer to the outbound link

I've described a solution in a different comment on this thread. For each outbound link on the page, build a link that points to a redirector that accepts two query parameters: current page's canonical URL and outbound link's URL. The redirector will redirect the browser back to the canonical URL. Upon receiving the request for the canonical URL, instead of serving normal content, the server redirects the browser to the outbound link's URL on the condition that its referrer came from the redirector. This way, the outbound link gets the correct referrer without using any javascript wizardry. In fact, you can use this technique to customize the referrer to whatever you want.

1. Browser visits http://a.com/pages/3?privacy_leaking_param=1

2. User clicks on an outbound link: http://b.com/

3. Browser gets redirected to redirector at:

    http://a.com/redirect?canonical_url=http%3A%2F%2Fa.com%2Fpages%2F3&outbound_url=http%3A%2F%2Fb.com%2F

    "canonical_url" is set to "http://a.com/pages/3"
    "outbound_url" is set to "http://b.com/"

4. Redirector logs the request and redirects browser to canonical_url (i.e. "http://a.com/pages/3)

5. Code behind http://a.com/pages/3 checks the referrer to see if it came from the redirector.

5a. If it is, parse the outbound_url from the referrer URL and redirect the browser to that URL.

5b. If it isn't, serve normal content.

Basically, every content page needs to also act as a redirector and only redirects when the referrer indicates that the previous request came from the redirector.

Re: How not to do URL redirects (… the way Quora does)

#55

Post by mcgwiz » Fri, Jan 20, 2012, 8:49 PM UTC

avlesh-singh wrote: post #41

kogir wrote: post #40

Best I can tell, there is zero incentive for Quora (or any other site, for that matter) to care. Their current redirect logic in no way hurts their user experience. Right now they protect their users' privacy. What benefit do they realize by providing their users' viewing history to other sites? I personally think that the referer header was never a good idea. I disable it in my browser, and appreciate sites that do…

Of course there is zero incentive for anyone to do it. And if everyone chose to link the way Quora does, you get a Google Analytics dashboard which cannot tell you what all URL's are sending traffic to your site/blog. I find it really difficult to imagine.

The long term effect would be that websites can no longer use referrer as a metric. What difference would that make? HTTP resources (webpages) shouldn't change semantic meaning depending on the referrer anyway. Doing so is arguably an unintended use (or abuse) of HTTP.

Re: How not to do URL redirects (… the way Quora does)

#56

Post by avlesh-singh » Sat, Jan 21, 2012, 6:15 AM UTC

mcgwiz wrote: post #55

avlesh-singh wrote: post #41

Earlier quoted context omitted.

Of course there is zero incentive for anyone to do it. And if everyone chose to link the way Quora does, you get a Google Analytics dashboard which cannot tell you what all URL's are sending traffic to your site/blog. I find it really difficult to imagine.

The long term effect would be that websites can no longer use referrer as a metric. What difference would that make? HTTP resources (webpages) shouldn't change semantic meaning depending on the referrer anyway. Doing so is arguably an unintended use (or abuse) of HTTP.

Absolutely! And see the funny reasons people have been citing in favor of such an act - http://www.quora.com/Why-does-Quora-redirect-to-URLs-in-a-wa...