Login/Register
Does http-equiv="refresh" keep referrer info and metadata?
Asked Answered
Solved htmlrefreshhttp-redirectbrowser-refresh
P

3

15

If I set up a page like this:

<html><head><meta http-equiv="refresh" content="0;url=http://internic.net/"></head><body></body></html>

Will the browser send referrer info and other metadata when the redirection is performed?

Plover answered 6/6, 2010 at 19:25 Comment(1)
Good question - my guess is "no". It's a new, separate request. – Decanal
H
13

In testing here, Firefox and IE do not but Chrome does send the referrer (though this is inconsistent as well), regardless of whether it's going to the same domain or not.

Seeing as I can't find any spec stating what should be the standard behavior, and W3C in general discourages a META redirect, I'm not sure you can ever depend on this being consistent.

Hopscotch answered 6/6, 2010 at 19:39 Comment(5)
The page you linked to says "The odd thing I found was that IE handles javascript and meta refreshes slightly differently than FireFox or Safari. Internet Explorer will null the REFERER when it hits the target site, while FireFox and Safari will both set the REFERER to the URL with the javascript or meta refresh code on it." Did it change since then? – Plover
@Waterfox - I'm testing here on local and on URLs, in each case chrome and Firefox aren't passing a referrer header at all, I have one more test on an external site to run, I'll comment again after it. – Hopscotch
@Waterfox - I tested on a remote domain and chrome is passing the referrer, which means it's not consistent like I thought...so you can't really depend on this one way or another it looks like. I presume Safari behaves like Chrome in this respect, but I don't have it to test with. – Hopscotch
What is the recommended kind of redirection? In fact, I don't want the referrer to be passed. – Plover
@Waterfox - You could direct to a page you have, via POST, etc, then have it redirect where you're going...all the other end will see is your redirect.whatever page, so nothing useful...this is a common way of hiding data from advertisers, etc. The preferred method would be a 301/302 Http Status Redirect, but these won't hide the referrer. – Hopscotch
A
3

I did some additional testing with this. I had three URIs involved (all on the same domain):

  • /page.html which had a link to the meta refresh
  • /refresh.html which used a meta refresh to the destination
  • /destination.html which used JavaScript to write the referrer into the page.

I ran the test in several browsers by opening page.html and clicking on the link, then observing what the referrer was on the destination. Here are the results:

  • Internet Explorer - No referrer
  • Firefox - No referrer
  • Chrome - Referrer: http://example.com/refresh.html
  • Safari - Referrer: http://example.com/refresh.html
  • Opera - Referrer: http://example.com/refresh.html

None of the browsers showed http://example.com/page.html as the referrer the way that they would with a 301 or 302 redirect. So meta refresh can be used to some extent to obscure the referrer:

  • Hide the specific page that had the link
  • Remove the query string from the referrer
  • If a third party site hosted the refresh, hide the specific site that linked
  • Remove the external referrer on incoming traffic (useful in situations like this)
Assemble answered 18/6, 2014 at 11:0 Comment(0)
O
2

Indeed, it's possible to trick Firefox and Internet Explorer, getting the same redirection result, with preserved referrer, by simply using a form with delayed submit.

Example:

<form action="URL" method="GET" name="redirected"></form>
<script>
   setTimeout(function() {
      document.forms.redirected.submit();
   }, 1000);
</script>
Oklahoma answered 25/10, 2018 at 11:59 Comment(2)
This is the actual answer – Befuddle
Worth noting that using this type of redirect can cause the annoying warning "the information you’re about to submit is not secure" in Google Chrome. Should be fine for securely hosted sites though. – Bumbailiff

© 2022 - 2024 — McMap. All rights reserved.