39

After a few tests, I'm starting to reach the conclusion that a browser does not send a Referer HTTP header when one clicks to a http page from a https one.

What security reason is that for? Is is defined somewhere in the standard?

4
  • In any case it is entirely up to the client if Referer should be set or not. Commented Sep 1, 2009 at 10:45
  • 1
    @Brian : but clients should follow/respect the RFC defining the protocol they are using. Commented Sep 1, 2009 at 10:46
  • The current accepted answer is a fine answer, but its the same as @avid's answer which was posted earlier. Commented Feb 21, 2016 at 18:41
  • @mikemaccana pffft, by less than a minute... well over 5 years ago... So thanks anyway, but meh ;-)
    – AviD
    Commented Feb 21, 2016 at 21:30

4 Answers 4

54

The HTTP RFC states, in section 15.1.3 Encoding Sensitive Information in URI's :

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.

So, this is expected / standard behaviour.

2
  • 2
    Ok, so how and why google sends referer from https to non-secured sites?
    – confiq
    Commented Mar 18, 2014 at 11:05
  • 2
    @confiq because it says SHOULD NOT? Commented Jul 9, 2014 at 5:01
21

Actually it's not that straight forward anymore (2014 onwards), according to this w3c document on referrer policy.

The default behaviour is that browsers will not send referrer information when going from HTTPS to HTTP. However, browsers will send referrer when going from HTTPS to HTTPS.

Also, in HTML5, there is a new meta tag named referrer, that looks like this:

<meta name="referrer" content="origin">

New browsers have already implemented this. So whether or not browsers will send referrer, will depend on this meta tag in the near future. If this meta tag is not included in page's HTML, then browsers will use the default behaviour.

Following are the possible values of content attribute of referrer meta tag:

  • no-referrer: Referrer will not be sent, regardless of HTTP or HTTPS
  • origin: Only the origin (main) domain will be sent as referrer
  • origin-when-crossorigin: Same origin will send full referrer URL and cross origin will send only origin URL as referrer
  • no-referrer-when-downgrade: This is the default behaviour when no referrer meta tag is provided on the page.
  • unsafe-url: This will always send referrer, regardless of HTTP or HTTPS

Also, there are some legacy attribute values for referrer meta tag. These are no longer recommended, but used in many sites at the moment:

  • never: same as no-referrer
  • default: same as no-referrer-when-downgrade
  • always: same as unsafe-url

I hope this information will be helpful to someone who just found this post after 2014.

1
  • Nice hint. However it does not work on all devices. :( The Chrome in PC/Mac works fine. But Chrome in Andorid does NOT work!
    – Kane
    Commented Sep 25, 2015 at 8:43
17

Yes, defined in the standard:

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol

1
  • 2
    I'll just add a bit of explanation, https urls often contain sensitive information, such as sessionid, account number, etc. Of course this is bad even over SSL, but its still done... And anyway, HTTPS sessions are usually sensitive applications, there's no reason to needlessly expose that info.
    – AviD
    Commented Sep 1, 2009 at 10:35
4

Reason: Sometimes SessionIDs are URL encoded. HTTP Pages can have cross site scripting which steals the session from the HTTPS communication. To prevent this, the referrer is not transmitted on the HTTPS to HTTP transition so that the URL encoded sessin ID can't be stolen.

4
  • op is asking for http -> https, not vice versa.
    – dsas
    Commented Jun 23, 2011 at 11:22
  • 2
    @dsas "when one clicks to a http page from a https one" means https -> http, not http -> https.
    – John Pick
    Commented Apr 3, 2012 at 4:45
  • @JohnPick you're right of course, I'm not sure how I misread that.
    – dsas
    Commented Apr 15, 2012 at 0:14
  • Is this because referrer is going to contain session ID sometimes?
    – Rn2dy
    Commented Dec 5, 2013 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.