Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

  "as it is in many cases now due to https"
That's not exactly true. Referrer is only hidden if it's explicitly asked by using a meta tag:

  <meta name="referrer" content="no-referrer" />
Or by using Referrer-Policy:

  Referrer-Policy: no-referrer
The default behavior is no-referrer-when-downgrade. This means that referrers from https to http are hidden. But https > https is still visible. And with https adaption reaching saturation, referer headers are usually still sent.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: