2

Let's admit that, for security / privacy reasons, I want to globally set my referrer policy to be "no-referrer".

For instance, using Apache's .htaccess's

Header always set Referrer-Policy no-referrer

IIS' web.config's

<configuration>
    <system.webServer>
        <httpProtocol>
            <customHeaders>
                <add name="Referrer-Policy" value="no-referrer" />
             </customHeaders>
        </httpProtocol>
    </system.webServer>
</configuration>

etc., etc. In other words, I want this policy to be globally enforced, for every single webpage.

However, for one particular domain (say https://validator.w3.org/), I'd like to send the referrer (for instance, to use the convenient url https://validator.w3.org/check?uri=referer).

I could use the experimental referrerpolicy attribute of links, but I don't know how well is that attribute supported. I don't know either if such an attribute can override the setting of the server.

The link type 'norefferer' attribute seems to be well supported, but I want to achieve the opposite!

How could I globally disallow the referer to be sent, except for links pointing to a particular domain?

  • If you were simply wanting to pass the referrer info for a particular external link, it can be done via redirecting to an intermediary page forced to http in htaccess. and changing the Referrer Policy on the intermediary page via a meta tag and adding a redirect via a meta refresh. I'm sure there are more elegant ways to achieve it, but it does work. However with that said, it doesn't work for validator.w3.org/check?uri=referer – Bronwyn V Oct 17 '17 at 8:11
  • So basically you want to pass referral data only to one site - but block your domain from appearing as a referral source for all others? Not sure I completely understand your underlying intention, or what this does for you, but you might find your answer here: developers.google.com/analytics/devguides/collection/… – Josh Salganik Oct 17 '17 at 12:09
  • @BronwynV Thanks for your comment. I'm not sure I understand the technicals details of your proposition, but if it doesn't work for validator.w3.org/check?uri=referer, then indeed it is of no use to me. – Clément Oct 17 '17 at 13:09
  • @JoshSalganik Yes, you got that right: I want the referrer to be transmitted only when accessing a particular website / domain. My underlying intentions are essentially to use validator.w3.org/check?uri=referer : Click on the link, if the referrer was transmitted, we would have landed on validator.w3.org/nu/… This save the burden of giving the precise link for every page. I don't see how my problem is related to google analytics. – Clément Oct 17 '17 at 13:13
  • 1
    If the primary goal, in this case, is to test the URL at the W3C validator, then you can pass the URL to be tested directly in the URL parameter. eg. https://validator.w3.org/check?uri=http://www.example.com/path/to/foo. – MrWhite Oct 23 '17 at 12:13
4
+50

Method 2

Following the concept of method 1 (below), I realised this could probably be done with just one technology and without reloading the current page. It's all done client side with plain javascript.

<!DOCTYPE html>
<head>
</head>
<body>
    <a href="https://validator.w3.org" id="allowReferrer">Link that you do want to allow referrer to be passed to</a>
    <a href="http://w3.org">Link that you don't want referrer to be passed to</a>

    <script>
    document.getElementById('allowReferrer').addEventListener('click', function(e){
        e.preventDefault();
        var metaRef = document.createElement("meta");
        metaRef.setAttribute("name", "referrer");
        metaRef.setAttribute("content", "origin");
        document.head.appendChild(metaRef);
        window.location.href=this.href;
    });
    </script>
</body>
</html>

(This code can definitely be improved - its just a proof of concept.)

Esentially there is an event listener on the allowReferrer ID which when triggered prevents the link to be followed, adds the referrer = origin meta tag to the head, then follows the link. Much tidier than method 1.

Method 1

I've just tested a rather convoluted solution, but its the only solution I can think of, and it did work.

<!DOCTYPE html>
<head>
    <?php
    if ($_GET["referrer"] == "true") {
        echo '<meta name="referrer" content="origin">';
        echo '<script>window.location.href = "'.$_GET["location"].'";</script>';
    } else {
        echo '<meta name="referrer" content="no-referrer">';
    }
    ?>
</head>
<body>
    <a href="http://example.com/?referrer=true&location=https%3A%2F%2Fvalidator.w3.org">Link that you do want to allow referrer to be passed to</a>
    <a href="http://google.com">Link that you don't want referrer to be passed to</a>
</body>
</html>

(This code can definitely be improved - its just a proof of concept.)

When the page loads it looks for a query parameter called 'refferer', if that is not set to "true" then the referrer meta tag is set to 'no-refferer', but if it is set to "true" then the referrer meta tag is set to 'origin' and javascript is executed to redirect you to a location held in second query parameter called 'location'.

All links will normally be followed without passing any referrer information. If you want a link to allow the referrer to be passed, then you would create your link as

[current URL]?referrer=true&location=[link which should be url encoded]

for example

http://example.com/test/some-page.php?referrer=true&location=https%3A%2F%2Fvalidator.w3.org

Its definitely not pretty, but until there is good support for the referrerpolicy attribute on the anchor tags, it might be the only way. Before using this solution, I would urge you to ask yourself how important it is that you have this functionality, and is it worth it?

  • 1
    Wow, thanks. That's definitely convoluted, and involves two technologies (php and JavaScript), whereas I was definitely thinking that a "pure" html (with some tweaking in Apache / Nginx / Windows Server, eventually) would exist. That's definitely ingenious, though, I wouldn't have think of it. – Clément Oct 19 '17 at 0:45
  • Thans @Clément - perhaps there is an easier way but at this point in time, this is the only solution I can think of. I will keep pondering on it and get back to you if I come up with anything else. – Josh Oct 19 '17 at 6:36
  • @Clément I've added another method which might be more desirable. I'm using the network panel in Chrome dev tools to identify what header is being passed, and this seems to be working too. – Josh Oct 19 '17 at 6:59
  • 1
    Thanks again for sharing your idea, Josh. I'm not marking your answer as accepted because I do hope that some nicer solution exists, but you deserves that bounty. – Clément Oct 23 '17 at 16:04
  • 1
    I would think so, but thought I'll give webmasters.stackexchange.com a chance! I think this question fits more the bill here, and won't cross-post, but feel free to do it if you want to. Keep me informed ;-) I slightly changed my question, making it more oriented toward overriding the server conf., so you could even ask your question without being a duplicate of that one. – Clément Oct 23 '17 at 16:33
-1

You can try in this way, although I am not sure if it's widely supported

 <a href="#link"  rel="referrer dofollow">link</a>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.