Confirmed users
908
edits
Security/Referrer: Difference between revisions
m
→Existing functionality: formatting of one pref name
(Move from https://public.etherpad-mozilla.org/p/referrerimprovements) |
m (→Existing functionality: formatting of one pref name) |
||
| (4 intermediate revisions by the same user not shown) | |||
| Line 19: | Line 19: | ||
*** 1 = send the URL without its query string | *** 1 = send the URL without its query string | ||
*** 2 = only send the origin | *** 2 = only send the origin | ||
* network.http.referer.XOriginPolicy | * <tt>network.http.referer.XOriginPolicy</tt> | ||
** controls whether or not to send a referrer across origins | ** controls whether or not to send a referrer across origins | ||
** values: | ** values: | ||
| Line 27: | Line 27: | ||
* <tt>network.http.referer.spoofSource</tt> | * <tt>network.http.referer.spoofSource</tt> | ||
** true = send the target URL as the referrer | ** true = send the target URL as the referrer | ||
* <tt>network.http.referer. | * <tt>network.http.referer.defaultPolicy</tt> | ||
** set the default referrer policy (which can be overriden by the site) | ** set the default referrer policy (which can be overriden by the site) | ||
** values: | ** values: | ||
| Line 34: | Line 34: | ||
*** 2 = strict-origin-when-cross-origin | *** 2 = strict-origin-when-cross-origin | ||
*** 3 = (default) no-referrer-when-downgrade | *** 3 = (default) no-referrer-when-downgrade | ||
* <tt>network.http. | * <tt>network.http.referer.defaultPolicy.pbmode</tt> | ||
** | ** same as above but only for Private Browsing | ||
* <tt>network.http.referer.hideOnionSource</tt> (only relevant for Tor?) | * <tt>network.http.referer.hideOnionSource</tt> (only relevant for Tor?) | ||
** true - strip out the referrer when it's a .onion address | ** true - strip out the referrer when it's a .onion address | ||
| Line 59: | Line 57: | ||
** we could specify the default (overridable by site owners) | ** we could specify the default (overridable by site owners) | ||
** https://bugzilla.mozilla.org/show_bug.cgi?id=1304623</s> | ** https://bugzilla.mozilla.org/show_bug.cgi?id=1304623</s> | ||
* Test different default for Private Browsing (Shield study) | * <s>Test different default for Private Browsing (Shield study)</s> | ||
** strict-origin-when-cross-origin seems like a good candidate | ** strict-origin-when-cross-origin seems like a good candidate | ||
** https://github.com/mozilla/privacy-prefs | ** <s>https://github.com/mozilla/privacy-prefs</s> | ||
** https://bugzilla.mozilla.org/show_bug.cgi?id=587523 | ** <s>https://bugzilla.mozilla.org/show_bug.cgi?id=587523</s> | ||
== Prior proposals == | == Prior proposals == | ||