4

Question

Is it an expected behavior of a browser acting like that?

Related Chromium bug

https://code.google.com/p/chromium/issues/detail?id=492761

Steps

  1. create an empty extension for Chrome

  2. put a newtab override into manifest.json: "chrome_url_overrides": {"newtab": "newtab.html"}

  3. create newtab.html (chrome-extension://<extension_id>/newtab.html), create an iframe and load some page into it, e.g. https://<some_page>.com/

  4. put a link to that page, e.g. https://example.org/

  5. click that link and observe the request

Expected result

The "Referer" header should be present, e.g.:

GET / HTTP/1.1
Host: example.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Referer: https://<some_page>.com/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,de;q=0.6,ru;q=0.4
Cookie: ...

Actual result

There's no "Referer" header:

GET / HTTP/1.1
Host: example.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,de;q=0.6,ru;q=0.4
Cookie: ...

1 Answer 1

7

"eroman at chromium.org" nails it down (see linked chromium bug report, already closed).

The thing is, when iframe contains a secured (https) page, but iframe itself is contained in a non-secured page (replaced Chrome newtab, in this case), then a non-secured (http) request is made when user click on a link from within that iframe.

RFC 2616 section 15.1.3 steps in saying:

Clients SHOULD NOT include a Referer header field in a (non-secure)
HTTP request if the referring page was transferred with a secure
protocol.

This makes described case a desired one, so browser behaves as expected by the standard.

Moreover, if a link points to a non-secure page, e.g. http://example.org/, it would be a normal (non-secure) http request, so "Referer" would be omitted - just because a referring page is secure. This is, of course, still valid even if there's no iframe wrapping a secured page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.