search

mikewest / http-state-tokens

Incrementally better HTTP state management.
https://mikewest.github.io/http-state-tokens/draft-west-http-state-tokens.html
Other
300 stars 8 forks source link

Omit Referer #4

Closed staabm closed 6 years ago

staabm commented 6 years ago

Should this spec define that a browser should not send the http referer with the token requests, as e.g. facebook could use their „like button widgets“ (or similar) to fingerprint the user with the given token?

mikewest commented 6 years ago

That's a reasonable kind of request to make from a privacy perspective, but it's somewhat orthogonal to the proposal here. I'd like to keep this focused on the mechanism of HTTP state management, not on wider issues of information flow in requests.

Thanks!