15

If I set up a page like this:

<html><head><meta http-equiv="refresh" content="0;url=http://internic.net/"></head><body></body></html>

Will the browser send referrer info and other metadata when the redirection is performed?

1
  • 2
    Good question - my guess is "no". It's a new, separate request.
    – Pekka
    Jun 6, 2010 at 19:32

3 Answers 3

13

In testing here, Firefox and IE do not but Chrome does send the referrer (though this is inconsistent as well), regardless of whether it's going to the same domain or not.

Seeing as I can't find any spec stating what should be the standard behavior, and W3C in general discourages a META redirect, I'm not sure you can ever depend on this being consistent.

5
  • The page you linked to says "The odd thing I found was that IE handles javascript and meta refreshes slightly differently than FireFox or Safari. Internet Explorer will null the REFERER when it hits the target site, while FireFox and Safari will both set the REFERER to the URL with the javascript or meta refresh code on it." Did it change since then?
    – Kudu
    Jun 6, 2010 at 19:45
  • 1
    @Waterfox - I'm testing here on local and on URLs, in each case chrome and Firefox aren't passing a referrer header at all, I have one more test on an external site to run, I'll comment again after it. Jun 6, 2010 at 19:47
  • @Waterfox - I tested on a remote domain and chrome is passing the referrer, which means it's not consistent like I thought...so you can't really depend on this one way or another it looks like. I presume Safari behaves like Chrome in this respect, but I don't have it to test with. Jun 6, 2010 at 19:51
  • What is the recommended kind of redirection? In fact, I don't want the referrer to be passed.
    – Kudu
    Jun 6, 2010 at 20:00
  • @Waterfox - You could direct to a page you have, via POST, etc, then have it redirect where you're going...all the other end will see is your redirect.whatever page, so nothing useful...this is a common way of hiding data from advertisers, etc. The preferred method would be a 301/302 Http Status Redirect, but these won't hide the referrer. Jun 6, 2010 at 20:04
3

I did some additional testing with this. I had three URIs involved (all on the same domain):

  • /page.html which had a link to the meta refresh
  • /refresh.html which used a meta refresh to the destination
  • /destination.html which used JavaScript to write the referrer into the page.

I ran the test in several browsers by opening page.html and clicking on the link, then observing what the referrer was on the destination. Here are the results:

  • Internet Explorer - No referrer
  • Firefox - No referrer
  • Chrome - Referrer: http://example.com/refresh.html
  • Safari - Referrer: http://example.com/refresh.html
  • Opera - Referrer: http://example.com/refresh.html

None of the browsers showed http://example.com/page.html as the referrer the way that they would with a 301 or 302 redirect. So meta refresh can be used to some extent to obscure the referrer:

  • Hide the specific page that had the link
  • Remove the query string from the referrer
  • If a third party site hosted the refresh, hide the specific site that linked
  • Remove the external referrer on incoming traffic (useful in situations like this)
2

Indeed, it's possible to trick Firefox and Internet Explorer, getting the same redirection result, with preserved referrer, by simply using a form with delayed submit.

Example:

<form action="URL" method="GET" name="redirected"></form>
<script>
   setTimeout(function() {
      document.forms.redirected.submit();
   }, 1000);
</script>
2
  • 1
    This is the actual answer
    – Sam
    Mar 15, 2019 at 16:45
  • Worth noting that using this type of redirect can cause the annoying warning "the information you’re about to submit is not secure" in Google Chrome. Should be fine for securely hosted sites though.
    – Bloopy
    Oct 28, 2021 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.