Some websites would whitelist referrers to prevent hotlinking resources from other websites (incurring potentially high bandwidth costs).
But overall I'm all for getting rid of it. It's a remnant of the early web that doesn't make a lot of sense these days, and creates more problems than it solves.
EDIT: Although I just realized that strict-origin-when-cross-origin (the new policy) would still let the hotlinking detection use case work, since you typically only need domain information for that. I initially thought that they would use same-origin or something like that. It'll teach me to comment before I read the linked story.
> VictorOps uses referrers as a "security measure" on login.
Using the referrer header as a security and privacy measure is prevalent among service providers. Vimeo even hilariously charges for this feature which is trivially bypassed; and I'd reckon their paying customers aren't even aware of it: https://vimeo.zendesk.com/hc/en-us/articles/224819527-Changi...
Maybe they advertise it as a security feature but it's still a good way to prevent unauthorized hotlinking that burns your vimeo bandwidth, costing you money (assuming it does indeed prevent random websites from embedding your videos).
This reminds me of some vague memories of a time long ago where some websites had a secure login page that asks for a username&pw but every other page after just checked the referall header. It wasn't a very secure system and people shared the header values needed to bypass logging in.
That's basically a degenerate form of capability-based security. Sharing the referrer header is delegating access rights. Of course, that's not actually a property you want in this case.
I've started to see quite a bit of that on websites dealing with transfer of medical data. I figured it was probably some sort of an effort to handicap MITM potential of impostor websites that were trying to steal credentials. My theory is that it might be some sort of a tripwire for the website to detect fishiness and lock the account.
I can't think of a single use case where a user would want a target site to know where they came from. Put that in the URL or something less nefarious if you want to communicate state.
I want some news sites to think I came from Google, because they will give up whole articles that are otherwise paywall-blocked. It's a dark SEO trick.
And likewise, the other sign it's Monday morning is when someone starts pontificating "this exists for some reason, so there must be someone using it for non-malicious purposes".
Which very well might be true, but that was exactly the question: who?
I use it to understand which site or link the user used to find an outdated link on our site. It's very helpful to know how he got there because often the references to that obsolete link are all purged in the code but somewhere deep inside the database or CMS somebody still put a link to the obsolete page.
well you can turn the header off pretty easily and you won't see many sites are breaking (alexa top 100), of course some wierd sites think it's important to use it, but because of the madness of referer there are so many things that will leak your privacy extremly, it came to the point that it's necessary to have extensions to remove the header or at least inject noreferer into a tags.
Yeah, we (Azure AD) got a couple of "login is broken" escalations when Chrome made this change. A couple vendors use it to validate a request is coming from the upstream IDP, to block drive by attacks I assume.
The first thing I thought of was when you go to a URL but it requires a login so it redirects you to the login page but then redirects you back to your original page after you login. Pretty sure it’s easily remedied without referer but that was the first thing I thought about.
that is a security issue on it's own. you should never have an openredirect bug, that's why openid servers need to store redirect uris somewhere and validate them.
Some ad networks use(d to use) referers for brand safety when resource serving an ad is embedded iframe. For example if the parent URL contains "osama-bin-laden-killed", don't display ad about nice family moments together (or anything else, likely)
Referer is an important way to maintain the security of an OAuth flow.
I don't know how commonly it would break that flow, but it certainly could depending on implementation details that are not narrowly prescribed by the OAuth2 spec.
The scenario is that the user is being phished with an uncompromised, modern browser. The idea is that if the attacker doesn't have control of the browser, they can't spoof the referer.
no referer is an important way to screw your security in an oauth2 flow. with oauth2 a correct configuration would be Referrer-Policy: no-referrer and enforcing a secure state param and csrf.
Isn't it also sort of useful information for site owners even if they are not maliciously slurping your private information?
For example you might not know that important site X linked to you and is driving Y% of your audience. You are not necessarily interested in the individuals following the links when you discover that.
This change only trims the referrer string, it doesn't remove the origin domain info. You can still tell that "important site X linked to you and is driving Y% of your audience." You just wouldn't be able to get any more granular than that.
His use only needs the domain, so should be unaffected? That said, something from my browser, probably ETP strict mode, appears to be stripping out the referrer entirely already anyway.
there are other ways to do the same, like a URL parameter. Referrer affects the privacy of everyone and the entire web. The fact that cashback systems for some small subset of internet users will be affected (and they have alternatives like URL parameters, they did not need to use referrer) is irrelevant.
I just tried to find references to it, but couldn’t. I’m wondering if my memory is broken. Slashdot is old though, we used to get worked up about bugs in X11 screensavers, and GNAA trollers.
Some sites use referrer as their "cookie session". One site use Cloudflare Anti-DDOS referrer as their cookie. Removing that referrer will cause the browser to infinity loop in CF Anti-DDOS because the site is expecting that referrer before entering the site.
I hate sharing Amazon shopping links because Amazon packs much referrer as possible in the link. Amazon uses the referrer to track who am I sharing to and use it for data for them to sells.
Are you conflating Referer with URL parameters? (Amazon calls them "ref tags" (referrer tags) but that's not HTTP Referer. It's not even possible to do what you are imagining with HTTP Referer, since Referer is only inside a browser session, not across from you to your friend.
Dang it, I didn't realize it was specific to HTTP. Thank you for pointing it out, all I see referrers (I somehow blank on HTTP) and I thought it was about the referrer tags.
