Clients SHOULD NOT include a
Referer
header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.” https://www.rfc-editor.org/rfc/rfc2616#section-15.1.3
According to the standard, https://google.com shouldn't send the Referer
header to non-secure sites, but it does. Do other HTTPS sites send the Referer
header to HTTP sites?
All these tests are done using Chrome v33.0.1750.117
To run the test I go to the first page, then open the console and manually do a redirect, using location = "http://reddit.com"
:
https://google.com -> http://www.reddit.com
Referer
header is kepthttps://startpage.com/ -> http://www.reddit.com
Referer
header is strippedhttps://bankofamerica.com -> http://reddit.com
Referer
header is strippedhttps://facebook.com -> http://reddit.com
Referer
header is stripped
Is Google doing something special to keep the Referer
header? Is there a list of HTTPS sites that keep the Referer
header? Are there any other cases where the Referer
header is removed?