Safari mobile and desktop are hiding full referrer URL: why?

Asked 5/6, 2020 at 22:35 Answered 12/7, 2020 at 11:15

Solved http url safari mobile-safari http-referer

I have a website, www.a.com

In that website, I serve a page at https://www.a.com/mypage that contains this:

<script src='https://www.b.com/anotherpage'></script>

If I visit from every browser, b.com will receive this as http referrer:

https://www.a.com/mypage

However, if I visit from Safari mobile or desktop, the referrer becomes:

https://www.a.com/

Why? How can I force Safari to send the full referrer?

Example:

from Safari, b.com logs:

123.45.678.901 - - [06/Jun/2020:00:32:03 +0200] "GET /anotherpage/ HTTP/1.1" 200 0 "https://www.a.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Mobile/15E148 Safari/604.1"

from another browser:

123.45.678.901 - - [06/Jun/2020:00:31:34 +0200] "GET /anotherpage/ HTTP/1.1" 200 0 "https://www.a.com/mypage/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"

I've tried adding this:

<meta name="referrer" content="unsafe-url">

or this

<meta name="referrer" content="always">

to the <head> of https://www.a.com/mypage but to no avail.

Alberik answered 5/6, 2020 at 22:35 Comment(0)

The incorrect behaviour in Safari (referrer being set to the domain only, without the URI), pertains to the fact that Prevent cross-site tracking is enabled. Setting:

<meta name="referrer" content="no-referrer-when-downgrade">
<meta http-equiv='Referrer-Policy' content='no-referrer-when-downgrade'>

or setting referrerPolicy="no-referrer-when-downgrade" on the element (iframe, script tag, etc)

does not affect it.

See https://www.arcolatheatre.com/disable-prevent-cross-site-tracking/

Hope this helps someone,

Utility answered 12/7, 2020 at 11:15 Comment(2)

Sorry the bounty already expired, because this is the only correct answer. Very helpful, thanks! – Alberik 12/7, 2020 at 23:27

Thanks, this is briliant. Saves me tons of time debugging. – Hoenir 12/3, 2022 at 17:8

The value that is sent as the Referer header is determined by the Referrer Policy in effect for a given request. The chosen policy can come from a browser default, a HTTP header, a meta tag, or an attribute on the individual tag.

The difference you're seeing is probably because browsers are moving from a default of no-referrer-when-downgrade (which would show the full path in your case) to strict-origin-when-cross-origin (which wouldn't, since it's a cross-origin request). Safari has presumably made that change while the others you tested haven't. (But note that Chrome will be adopting the new default in version 85).

Your attempt to use the meta tag should work, so if it doesn't, something might be interfering. You could try using one of the other mechanisms, like a Referrer-Policy header or a <meta http-equiv='Referrer-Policy' content='no-referrer-when-downgrade'> tag. Unfortunately, according to MDN Safari doesn't support the referrerpolicy attribute on the script tag.

Itching answered 5/7, 2020 at 0:38 Comment(0)

-2

You can't display the complete URL from your website confirguration/header. Now it is a configuration of your web browser.

This is not a newest behavior, since 2014 apple is preventing to display url addresses can be bloated with incomprehensible text

You can take this references: Next Safari for Mac hides full Web addresses

Now, that is the "normal" behavior for Safari for iOS devices and Macs, but that doesn't means you can't disable it. If you want it, you can show full url's, you can go to Safari > Preferences > Advacned > Select Show full website address.

You can take this as a reference:

How to Show the Full Website URL in Safari for Mac OS

How to Stop Safari From Hiding URL's

How to See the Entire URL in Safari's Address Bar

Railhead answered 28/6, 2020 at 20:20 Comment(3)

My question is not about the URL you see in the address bar but the one sent in the HTTP Referrer header (unless the 2 things are linked?) – Alberik 29/6, 2020 at 7:17

@Alberik yes, are linked. Is not possible display full urls without modify the preferences in your system – Railhead 29/6, 2020 at 10:0

@Alberik I updated the answer. Sorry, it is not possible, now the url format is part of the web browser not the html page – Railhead 29/6, 2020 at 13:59

Recommended topics

Hot tags