I was able to set up a link from an HTTPS page to a HTTP page on another domain and still pass the first page's URL as a referrer using the following technique.
Definitions
Origin page: HTTPS page where the link to the HTTP hosted destination page is situated. In this example: https://example1.com/origin.html
Destination page: HTTP page which has access to the referrer of the origin page. In this example: http://example2.com/destination.html
Basic plan
This has the effect of making the redirect come from the HTTP version of the origin page:
Link on HTTPS origin page links to the current page but adds a query parameter for the destination page[1]. e.g: https://example1.com/origin.html?goto=http://example2.com/destination.html
When link is clicked the server at example1.com interrupts the standard request when the query parameter 'goto' is present. It then:
- Stores the 'goto' parameter in a 'goto' cookie.
- Removes the 'goto' parameter and value from the current request's url
- 302 redirects to this new cleaned url on the HTTP version of the origin domain ie.
http://example1.com/origin.html
The server checks on every request for a 'goto' cookie and if present will clear the cookie and then render a very simple redirect page. This page contains[2]:
- A Javascript window.location.replace() script that redirects to the goto cookie url.
- A Meta Refresh tag with the value of the goto cookie url and a delay of a few seconds.
- A link to the goto cookie url.
Notes
[1] This basic solution is an open redirector and some consideration should be given to protecting against bad guys using the goto query parameter to redirect UAs in phishing attacks.
[2] Not all browsers will send the referrer when redirecting via a JS redirect or meta refresh tag. In my testing IE8 and lower does not pass the referrer.
I'm not sure if this technique will allow search engine crawlers to follow the links. This is not important for my requirements.
If the UA has cookies disabled then this will just redirect to the origin page again.
Allowing HTTP connections just for redirects
On my server I have an Apache rule for enforcing HTTPS regardless of the request:
<VirtualHost *:80>
ServerName example1.com
# if not on port 443 then 301 redirect to https while keeping any query string
RewriteEngine On
RewriteCond %{HTTP_HOST} ^example1\.com$ [NC]
RewriteCond %{SERVER_PORT} !443
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [L,QSA,R=301]
In order for the redirection technique above to work I need some way to conditionally permit HTTP connections. There are many ways to do this. I decided a cookie will work.
<VirtualHost *:80>
ServerName example1.com
# if not on port 443 then 301 redirect to https while keeping any query string
RewriteEngine On
RewriteCond %{HTTP_HOST} ^example1\.com$ [NC]
RewriteCond %{SERVER_PORT} !443
RewriteCond %{HTTP_COOKIE} !disable_ssl [NC]
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [L,QSA,R=301]
The disable_ssl cookie would be set in step 2 and then deleted in step 3.
Originshould be intact, may not fit your use case though.