Ability to neutralize HTTP referrer for enhanced privacy

[gorhill]

Re. privacy.

Because the Chrome API doesn't allow more than one extension to change the outgoing headers, and since HTTPSB must already potentially change the outgoing headers (to remove cookies), this means that using another extension to change the HTTP referrer alongside HTTPSB won't work. So HTTPSB must provide this feature, or else a user will have to forfeit one of the two extensions.

[ghost]

Funny! Issues #99 and #100 were the next suggestions I intended to make ;-) Raymond, you're amazing!

By implementing those enhancements HTTPSB will become an all-in-one solution which will make using a couple of other extensions superfluous. Great! However, I suggest that those features are disabled by default in order to avoid demanding too much from your users.

I've been using the Firefox extension RefControl (http://www.stardrifter.org/refcontrol/) for years and Referer Control in Chrome for some months. What is said on the RefControl site:
"Setting it to Block for 3rd Party requests only is a fairly good compromise between privacy and not breaking sites."
is what should be set as the default behaviour in HTTPSB, IMO. Otherwise it would simply break too many sites. It's still important that sites can be easily added as exceptions; this should be done in a menu (Referer Control uses a context menu entry) and not manually as this would be probably too complicated for most users.

[gorhill]

What I will provide will be as simple as possible, something basic but which does the job. I am considering the idea of nulling the referer field if both following conditions are fulfilled:

• the domain name of the referer is different than the domain name of the destination page
• the hostname of the destination is not whitelisted

This way, the amount of code is minimal, the extra overhead to OnBeforeSendHeaders() is acceptable, and one single setting to add in the Settings page: "Remove referer information from request to non-whitelisted hostnames".

Example: top page of arstechnica.com, an embedded request for an image:

Request URL: http://noembed.com/faviconp/?url=http%3A%2F%2Fmidsizeinsider.com%2Fen-us%2Farticle%2Fdemocratization-big-data-marketing-any-size-organi
Referer field: http://arstechnica.com/

So with the feature, the referer would be nulled in the above case.

[ghost]

Sounds good to me. It doesn't go as far as what I suggested from the RefControl example but I understand that this will be the easiest solution.

[gorhill]

Fixed in 34a237d.