从 SSL 站点链接到非 SSL 站点时的 Referer 标头
RFC 2616 中的第 15.1.3 节指出：
如果引用页面是使用安全协议传输的，客户端不应在（非安全）HTTP 请求中包含 Referer 标头字段
但是，我知道许多浏览器都有错误并且并不总是遵循规范，而且它只说不应该，而不是“不得”。所以我的问题是：
1）是否有任何浏览器（过去、现在或测试版）违反规范并且在从安全站点发出请求时发送引用标头
2）是否有任何工具、浏览器插件或任何方法可以修改浏览器以违反规范并在发出此类请求时发送引用标头
3）我可以在网络上的任何地方查看是否有任何官方的声音来源，或者来自安全专家的关于此问题的大量信息。
作为一些背景知识，这是我的应用程序安全审查的一部分，该应用程序通过 SSL 运行，并且规范是不应将引用信息发送到第 3 方网站。我的测试发现没有浏览器会在这种情况下发送引用标头，但我非常有信心我是对的。
Section 15.1.3 in RFC 2616 states:
Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol
However, I know many browsers have bugs and don't always follow spec, plus it only says SHOULD NOT, instead of MUST NOT. So my question is therefore:
1) Is there any browser (past, present, or beta) that breaks spec and DOES send the referer header when a request is made from a secure site
2) Are there any tools, browser plugins, or any way at all to modify a browser to break spec and send the referer header when making such a request
3) Is there any official sounding source, or load of information from security pros about this problem anywhere on the web that I can look at.
For a bit of background, this is part of a security review of my app which runs over SSL, and the spec is that no referer information should be sent to 3rd party sites. My testing has found no browser that will send the referer header in this scenario, but I would like to be very confident that I'm right.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
默认情况下，在 Firefox 中，如果第 3 方站点通过 HTTPS，则将根据
network.http.sendSecureXSiteReferrer选项（可通过地址栏中的about:config访问）。By default in Firefox, if the 3rd-party site is over HTTPS, the referer header will be sent, according to the
network.http.sendSecureXSiteReferreroption (accessible viaabout:configin the address bar).