Why isn't the Referral Removed for Google HTTPS -> HTTP

问题

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol. https://tools.ietf.org/html/rfc2616#section-15.1.3

According to the standard, https://google.com shouldn't send the referral to non-secure sites, but it does. Do other HTTPS sites send the referral to HTTP sites?

All these tests are done using Chrome v33.0.1750.117

To run the test I go to the first page, then open the console and manually do a redirect. location = "http://reddit.com";

Ex.

https://google.com -> http://www.reddit.com Referral is kept

https://startpage.com/ -> http://www.reddit.com Referral is stripped

https://bankofamerica.com -> http://reddit.com Referral is stripped

https://facebook.com -> http://reddit.com Referral is stripped

Is Google doing something special to keep the referral? Is there a list of HTTPS sites that keep the referral? Are there any other cases where the referral is removed?

Thanks!

回答1:

cnst answers this correctly above; it's content="origin". That forces browsers going HTTPS->HTTPS and HTTPS->HTTP to have the request header:

http-referer=https://www.google.com

This functionality allows sites to get credit for traffic without leaking URL parameters to a third party. It's awesome, as it's so much less hacky than what people have used here in the past.

There are currently three competing specs for this. I don't know which one is authoritative, and suspect it's a mix. They're similar, on most points.

http://www.w3.org/TR/referrer-policy/
http://w3c.github.io/webappsec/specs/referrer-policy/
https://wiki.whatwg.org/wiki/Meta_referrer

Here's available support, that I know of; would love for people to let me know if I'm wrong or missing anything.

Now:

Chrome 17+ supports this on desktop
Chrome 25+ for mobile devices
Safari 6 on iPad and iPhone

Unknown version:

Desktop Safari 7 supports this; possible support in earlier versions, but I don't have a browser to confirm.

Upcoming real soon now:

IE12 Beta has working support (new this week).
Firefox 38 has the code checked in for a May 2015 release. https://bugzilla.mozilla.org/show_bug.cgi?id=704320

回答2:

When you do a Google Search with Google Chrome, the following tag appears in the search results:

<meta content="origin" id="mref" name="referrer">

The origin value means that instead of completely omitting the Referer when going to http from https, the origin domain name should be provided, but not the exact page within the site (e.g. search strings will remain private).

On the other hand, link aggregators like lobsters have the following, which ensures that the whole URL will always be provided in the Referer (by browsers like Chrome and Safari), since link stories are public anyways:

<meta name="referrer" content="always" />

As of mid-2014, this meta[@name="referrer"] is just a proposed functionality for HTML5, and it doesn't appear to have been implemented in Gecko, for example -- only Chrome and Safari are claimed to support it.

http://smerity.com/articles/2013/where_did_all_the_http_referrers_go.html

https://bugzilla.mozilla.org/show_bug.cgi?id=704320

http://wiki.whatwg.org/wiki/Meta_referrer