[whatwg] several messages about a way to disable referer headers for links

[Ian Hickson]

On Wed, 18 Jan 2006, Tyler Close wrote:
> 
> Just as many sites use redirects, instead of direct external links, for 
> click tracking, many sites also use redirects to control the HTTP 
> referer header. For example, if you click on a hyperlink in GMail, it 
> will use a redirect that prevents sending of the HTTP referer header. 
> It's often a good idea to do this when the link source is a private 
> resource, such as an email.
> 
> It would be nice to be able to directly specify the referer behaviour on 
> the <a> element, instead of resorting to the same trickery currently 
> used for click tracking.

That seems reasonable...


On Wed, 18 Jan 2006, Tyler Close wrote:
> 
> Here's a concrete proposal for what this could be:
> 
> The <a> element gets a new attribute named "referer" [sic]. The possible 
> values are: "none|site|path|page", where the value of the Referer header 
> is:
> 
> "none": The Referer header must not be sent
> "site": The request URI, stripped of the path and query components
> "path": The request URI, stripped of the query component
> "page": The request URI
> 
> For example, for a document fetched from <http://example.com/a/b/c?q#f>, 
> the Referer for a clicked <a> element would be:
> 
> "none": No Referer sent
> "site": http://example.com/
> "path": http://example.com/a/b/c
> "page": http://example.com/a/b/c?q
> 
> In an ideal world, it might be nice to also have a "link" option, where 
> the Referer header would contain the request URI with a fragment 
> appended, whose value is the "name" attribute of the clicked <a> 
> element. This feature would give us a kind of bidirectional link. 
> Unfortunately, RFC 2616 forbids fragments in the Referer header.

This seems a bit like overkill. :-)


On Thu, 19 Jan 2006, Jasper Bryant-Greene wrote:
> 
> I quite like this proposal, but while we're at this early stage, it 
> might be nice to correct the spelling to "referrer" on the attribute... 
> fix a mistake made long ago by the HTTP guys...

Yeah... the difficulty is that fixing the spelling means being 
inconsistent, which is at least as confusing to everyone.


On Wed, 25 Jan 2006, Tyler Close wrote:
> 
> [...]

Ok, I've added a rel value similar to "nofollow" called "noreferer" that 
does this.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'