Hacker News new | ask | show | jobs
by vince14 1890 days ago
The destination site still receives the referrer header, sent by your browser via HTTPS. Further measures are needed like this one.
1 comments
londons_explore 1890 days ago
You're mistaken. MdN says:

strict-origin-when-cross-origin (default) Send the origin, path, and querystring when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS).

So no path is sent to the destination of a link over https - only the domain.

link
vince14 1889 days ago
You left out the part which contradicts your claim.

> Don't send the Referer header to less secure destinations (HTTPS→HTTP).

The referer header is still sent from HTTPS to HTTPS.

link
londons_explore 1889 days ago
Yes, but only with the domain not the full path. Does anyone really care that the domain is leaked? There are very few secret domains...
link