Hacker News new | ask | show | jobs
by bji9jhff 43 days ago
For the privacy of the user, nowadays the referer header are either shortened or voided by the browser. You reintroducing the string by a side-channel could be seen by users as a backstab, even if you see it as "etiquette".
1 comments
extraduder_ire 43 days ago
At the very least, people seem to have settled on one or two args to use for this. e.g. "utm_source".

I tried entering ?utm_source=foo on Chris's site when it was posted the other day, and was surprised it didn't trigger the page. Pretty sure one or more of my firefox extensions remove that specific one from URLs before making the request.

Facebook combining tracking and IDs into an opaque UUID in URLs so they can't be removed is a level of user hostility beyond this.

link
chrismorgan 42 days ago
Firefox’s Enhanced Tracking Protection removes a few such parameters.

Now I have the stupid contrary idea, require a specific query string parameter to be present…

link
chrismorgan 42 days ago
I must correct myself: utm_* is not part of Firefox’s query stripping, which only removes about 23 parameters: https://firefox.settings.services.mozilla.com/v1/buckets/mai...

For me, it comes from uBlock Origin’s AdGuard/uBO – URL Tracking Protection list, which removes almost three hundred parameters unconditionally and a lot more conditionally: https://github.com/uBlockOrigin/uAssets/blob/master/filters/...

(A few of the parameters in that list are a little alarming in a you-could-easily-name-a-legitimate-parameter-this sort of way, like user_email_address, maf and taid.)

link