Some websites would whitelist referrers to prevent hotlinking resources from other websites (incurring potentially high bandwidth costs).
But overall I'm all for getting rid of it. It's a remnant of the early web that doesn't make a lot of sense these days, and creates more problems than it solves.
EDIT: Although I just realized that strict-origin-when-cross-origin (the new policy) would still let the hotlinking detection use case work, since you typically only need domain information for that. I initially thought that they would use same-origin or something like that. It'll teach me to comment before I read the linked story.
> VictorOps uses referrers as a "security measure" on login.
Using the referrer header as a security and privacy measure is prevalent among service providers. Vimeo even hilariously charges for this feature which is trivially bypassed; and I'd reckon their paying customers aren't even aware of it: https://vimeo.zendesk.com/hc/en-us/articles/224819527-Changi...
Maybe they advertise it as a security feature but it's still a good way to prevent unauthorized hotlinking that burns your vimeo bandwidth, costing you money (assuming it does indeed prevent random websites from embedding your videos).
This reminds me of some vague memories of a time long ago where some websites had a secure login page that asks for a username&pw but every other page after just checked the referall header. It wasn't a very secure system and people shared the header values needed to bypass logging in.
That's basically a degenerate form of capability-based security. Sharing the referrer header is delegating access rights. Of course, that's not actually a property you want in this case.
I've started to see quite a bit of that on websites dealing with transfer of medical data. I figured it was probably some sort of an effort to handicap MITM potential of impostor websites that were trying to steal credentials. My theory is that it might be some sort of a tripwire for the website to detect fishiness and lock the account.
I can't think of a single use case where a user would want a target site to know where they came from. Put that in the URL or something less nefarious if you want to communicate state.
I want some news sites to think I came from Google, because they will give up whole articles that are otherwise paywall-blocked. It's a dark SEO trick.
But overall I'm all for getting rid of it. It's a remnant of the early web that doesn't make a lot of sense these days, and creates more problems than it solves.
EDIT: Although I just realized that strict-origin-when-cross-origin (the new policy) would still let the hotlinking detection use case work, since you typically only need domain information for that. I initially thought that they would use same-origin or something like that. It'll teach me to comment before I read the linked story.