The Referer [sic] request-header field allows the client to specify,
for the server's benefit, the address (URI) of the resource from which
the Request-URI was obtained. (the "referrer", although the header field is misspelled.) This The Referer request-header allows a server to generate lists of back-links
to resources for interest, logging, optimized caching, etc.
It also allows obsolete or mistyped links to be traced for maintenance.
The Referer field must not MUST NOT be sent if the Request-URI was obtained from a source
that does not have its own URI, such as input from the user keyboard.
If a partial URI is given the field value is a partial relative URI, it should SHOULD be interpreted relative to the
Request-URI. The URI must not MUST NOT include a fragment. {2616} See section 15.1.3 for security considerations.
欄値が相対 URI の場合、これは Request-URI (要求 URI)
との関係であると解釈されるべきものです。 URI は素片 (fragment)
を含んでいてはなりません。安全性についての第15.1.3節も参照して下さい。
{1945,2068} Note: Because the source of a link may be private information or
may reveal an otherwise private information source, it is strongly
recommended that the user be able to select whether or not the
Referer field is sent. For example, a browser client could have a
toggle switch for browsing openly/anonymously, which would
respectively enable/disable the sending of Referer and From information.
The Referer field {2616} header allows reading patterns to be studied and reverse
links drawn. Although it can be very useful, its power can be abused
if user details are not separated from the information contained in
the Referer. Even when the personal information has been removed, the
Referer field may {2616} header might indicate a private document's URI whose
publication would be inappropriate.
Because the source of a link might be private information or might
reveal an otherwise private information source, it is strongly
recommended that the user be able to select whether or not the
Referer field is sent. For example, a browser client could have a
toggle switch for browsing openly/anonymously, which would
respectively enable/disable the sending of Referer and From information.
リンクの始点が私的な情報であったり、本来私的な情報源を晒すことになったりするかもしれませんから、
Referer 欄を送るかどうかを利用者が選択できるようにすることを強く推奨します。
例えば、ブラウザ・クライアントでは、公開で閲覧するか匿名で閲覧するかの切替器を用意して、
Referer や From の情報の送信を有効にするか無効にするか指定するようにできます。
Clients SHOULD NOT include a Referer header field in a (non-secure)
HTTP request if the referring page was transferred with a secure protocol.
[116] Re: History of device independence, User-Agent header?
( (Sean B. Palmer 著, 版))
http://lists.w3.org/Archives/Public/public-webhistory/2014Jul/0002.html
[130] Request Headers in the HTTP protocol
( ( 版))
http://www.w3.org/Protocols/HTTP/HTRQ_Headers.html#z14
[106] 141641 – disabling cross-site HTTPS referrers breaks sites [was: when leaving https, should send host+port as referrer instead of no referer]
( ( 版))
https://bugzilla.mozilla.org/show_bug.cgi?id=141641
[131] Web Applications 1.0 r7341 Attempt to actually define what Referer headers are used for a whole host of things that were poorly defined. Also: cleanup of a bunch of editorial mistakes I found from past such attempts. Mark every fetch algorithm use for sanity in the future. Block data:, javascript:, and about:blank referrers. Note: This relies on not-yet-done changes to CORS and XHR.
( ( 版))
http://html5.org/tools/web-apps-tracker?from=7340&to=7341
[1250] Protecting Privacy with Referrers
( ( 版))
http://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919
[1251] [whatwg] Feedback on Meta referrer
( (Adam Barth 著, 版))
http://lists.w3.org/Archives/Public/public-whatwg-archive/2012Jan/0243.html
[1252] ISSUE-39: Discuss CSP relevant use cases for possibly including Meta Referrer as a CSP directive - Web Application Security Working Group Tracker
( ( 版))
http://www.w3.org/2011/webappsec/track/issues/39
[1254] Issue 309551 - chromium - CSP 1.1: Implement 'referrer' directive. - An open-source project to help move the web forward. - Google Project Hosting
( ( 版))
https://code.google.com/p/chromium/issues/detail?id=309551
[1256] Put in Referrer Policy hook link · d5fc282 · whatwg/fetch
( ( 版))
https://github.com/whatwg/fetch/commit/d5fc28228d0842680e3a33a8c1a7d215315d13ef
[117] [REFERRER] Where does "Determine request’s Referrer" get its URL from?
( (Ian Hickson 著, 版))
http://lists.w3.org/Archives/Public/public-webappsec/2014Jul/0101.html
[122] REFERRER: Ignore case when evaluating tokens. · 0a26369 · w3c/webappsec
( ( 版))
https://github.com/w3c/webappsec/commit/0a263697170b88524c0be685a54f16711a6a0e14
[123] REFERRER: Be a bit more specific about case-insensitivity. · a30ed4e · w3c/webappsec
( ( 版))
https://github.com/w3c/webappsec/commit/a30ed4e5cded7f42bd5f5dfc65a194587f54ccd6
[1242] Web Applications 1.0 r7710 Integrate with URL standard.
( ( 版))
http://html5.org/tools/web-apps-tracker?from=7709&to=7710
[1243] Web Applications 1.0 r7762 I totally broke document.referrer a few weeks ago.
( ( 版))
http://html5.org/tools/web-apps-tracker?from=7761&to=7762
[1244] [whatwg] Question about document.referrer (and document.URL, document.location.href) when IDN domains are in use
( ( 版))
http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2013-July/040031.html
[1245] [whatwg] Question about document.referrer (and document.URL, document.location.href) when IDN domains are in use
( ( 版))
http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2013-September/040748.html
[124] Web Applications 1.0 r8848 fix a mess I made with 'referrer source' recently
( ( 版))
https://html5.org/r/8848
[125] Web Applications 1.0 r8853 Drop the 'responsible document' concept. This also changes the referrer to use when launching a nested worker to be the URL of the outer worker instead of the URL of the outer Document, which made no sense really.
( ( 版))
https://html5.org/r/8853
[6] Fix the order of CSP, HSTS, Mixed Content, and Referrer https://www.w3.o... · b8c2c49 · whatwg/fetch
( 版)
https://github.com/whatwg/fetch/commit/b8c2c4964c233cd3616042c04e2c14e0ff25485d
[25] Integrate Fetch into HTML · whatwg/html@7c5555a
( 版)
https://github.com/whatwg/html/commit/7c5555a16f2920c02244c10756bb2f1a11e87a22
[26] Never send a referrer with hyperlink auditing pings · whatwg/html@faec3a5
( 版)
https://github.com/whatwg/html/commit/faec3a50ea181f322ab9819975e285ced34a0308
[27] Use USVString for document.domain/referrer/cookie · whatwg/html@8170d82
( 版)
https://github.com/whatwg/html/commit/8170d82a2fc93c8ff7981c54aa4ccafd54204552
[89] The Platform for Privacy Preferences 1.0 (P3P1.0) Specification
( ( 版))
http://www.w3.org/TR/P3P/#safezone
[90] The Platform for Privacy Preferences 1.0 (P3P1.0) Specification
( ( 版))
http://www.w3.org/TR/P3P/#other_http_info
[211] Define the document's referrer in terms of Fetch
( (annevk著, ))
https://github.com/whatwg/html/commit/148dcd7d8214433b80de92b19d27cc5de128f849
[212] Fix referrer calculation to not refer to "API referrer source" (#58)
(domenic著, )
https://github.com/w3c/webappsec-referrer-policy/commit/2d78da2dba8f7ca75c5a0aef8db4ceeae59e0074
[167] Omit Referer header when referrer is "no-referrer"
(annevk著, )
https://github.com/whatwg/fetch/commit/7feaed2cc1d4ac97ea6a3f47ab6aa50e7377e161
[168] Fix use of "active document" in determining referrer (#63)
(estark37著, )
https://github.com/w3c/webappsec-referrer-policy/commit/301ed67dc160c8d0ca8e72e7e5b076088cf611b1
[222] Editorial: replace UTF-8 encode with isomorphic encode by annevk · Pull Request #742 · whatwg/fetch
()
https://github.com/whatwg/fetch/pull/742
[223] Use "isomorphic decode" explicitly for Refresh headers · Issue #3924 · whatwg/html
()
https://github.com/whatwg/html/issues/3924
[178] Codify user agent flexibility with regard to referrer values. by mikewest · Pull Request #127 · w3c/webappsec-referrer-policy · GitHub
()
https://github.com/w3c/webappsec-referrer-policy/pull/127
[177] Codify user agent flexibility with regard to referrer values.
(@johnwilander著, )
https://github.com/w3c/webappsec-referrer-policy/commit/31577f26f47d81bf390ca4f04f217468d742fcf1