Avatar for Username

Pomoc pśepytaś

Glědajśo se wobšudy pomocy. Njenapominajomy was nigda, telefonowy numer zawołaś, SMS pósłaś abo wósobinske informacije pśeraźiś. Pšosym dajśo suspektnu aktiwitu z pomocu nastajenja „Znjewužywanje k wěsći daś“ k wěsći.

Dalšne informacije

Toś ta nitka jo se archiwěrowała. Pšosym stajśo nowe pšašanje, joli trjebaśo pomoc.

Firefox private browsing trims request referrer headers.

  • 1 wótegrono
  • 1 ma toś ten problem
  • 7 naglědow
  • Slědne wótegrono wót philipp

matthew.was
matthew.was
more options

A site I develop for checks authenticity by checking a passed value confirming it it valid for a given referring url. The request has a referrer header which in regular windowed firefox is the full url of the requesting site. In private browsing mode the referrer header is only the host part of the url and does not contain the full path. It is the path that is commonly required to verify the site. Is this expected behaviour or a bug?

This has been confirmed both on macOS and Windows 10 using Firefox Quantum 61.0.

A site I develop for checks authenticity by checking a passed value confirming it it valid for a given referring url. The request has a referrer header which in regular windowed firefox is the full url of the requesting site. In private browsing mode the referrer header is only the host part of the url and does not contain the full path. It is the path that is commonly required to verify the site. Is this expected behaviour or a bug? This has been confirmed both on macOS and Windows 10 using Firefox Quantum 61.0.

Wšykne wótegrona (1)

philipp
philipp
  • Moderator
more options

hi, yes that appears to be the intended behaviour accoring to https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/