{"id":99537,"date":"2021-03-22T22:23:04","date_gmt":"2021-03-22T20:23:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-87-budet-urezano-soderzhimoe-http-zagolovka-referer"},"modified":"2021-03-22T22:23:04","modified_gmt":"2021-03-22T20:23:04","slug":"v-firefox-87-budet-urezano-soderzhimoe-http-zagolovka-referer","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-firefox-87-budet-urezano-soderzhimoe-http-zagolovka-referer","title":{"rendered":"Firefox 87 will limit the content of the HTTP Referer header","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Mozilla has changed the method for generating the HTTP Referer header in the upcoming Firefox 87 release scheduled for tomorrow. To block potential leaks of confidential data, the Referer HTTP header will, by default, include only the domain instead of the full URL of the source that led to the transition when navigating to other sites. The path and query parameters will be stripped. Thus, instead of 'Referer: https:\/\/www.example.com\/path\/?arguments', 'Referer: https:\/\/www.example.com\/' will be sent. This kind of sanitization was previously carried out in private browsing mode starting from Firefox 59, but will now be extended to the main mode. <\/p>\n
The new behavior will help prevent unnecessary user data from being shared with advertising networks and other external resources. For instance, some medical websites are mentioned, where third parties may obtain confidential information such as age and the diagnosis given to the patient during ad display. However, the removal of details from the Referer may negatively impact the collection of traffic statistics by website owners, who will now be unable to accurately determine the address of the previous page, such as understanding from which specific article the navigation occurred. The functioning of some dynamic content generation systems that parse keys leading to navigation from the search engine may also be disrupted. <\/p>\n
To manage Referer settings, there is an HTTP header called Referrer-Policy that allows website owners to override the default behavior for transitions from their site and return full information in the Referer. Currently, the default policy is 'no-referrer-when-downgrade', which means that the Referer is not sent when transitioning from HTTPS to HTTP but is sent in full form when loading resources via HTTPS. Starting with Firefox 87, the 'strict-origin-when-cross-origin' policy will take effect, which involves stripping paths and parameters when sending requests to other hosts over HTTPS, removing the Referer when transitioning from HTTPS to HTTP, and providing the full Referer for internal transitions within the same site. <\/p>\n