Does http-equiv=“refresh” keep referrer info and metadata?

StackOverflow https://stackoverflow.com/questions/2985579

Question

If I set up a page like this:

<html><head><meta http-equiv="refresh" content="0;url=http://internic.net/"></head><body></body></html>

Will the browser send referrer info and other metadata when the redirection is performed?

Was it helpful?

Solution

In testing here, Firefox and IE do not but Chrome does send the referrer (though this is inconsistent as well), regardless of whether it's going to the same domain or not.

Seeing as I can't find any spec stating what should be the standard behavior, and W3C in general discourages a META redirect, I'm not sure you can ever depend on this being consistent.

OTHER TIPS

I did some additional testing with this. I had three URIs involved (all on the same domain):

  • /page.html which had a link to the meta refresh
  • /refresh.html which used a meta refresh to the destination
  • /destination.html which used JavaScript to write the referrer into the page.

I ran the test in several browsers by opening page.html and clicking on the link, then observing what the referrer was on the destination. Here are the results:

  • Internet Explorer - No referrer
  • Firefox - No referrer
  • Chrome - Referrer: http://example.com/refresh.html
  • Safari - Referrer: http://example.com/refresh.html
  • Opera - Referrer: http://example.com/refresh.html

None of the browsers showed http://example.com/page.html as the referrer the way that they would with a 301 or 302 redirect. So meta refresh can be used to some extent to obscure the referrer:

  • Hide the specific page that had the link
  • Remove the query string from the referrer
  • If a third party site hosted the refresh, hide the specific site that linked
  • Remove the external referrer on incoming traffic (useful in situations like this)

Indeed, it's possible to trick Firefox and Internet Explorer, getting the same redirection result, with preserved referrer, by simply using a form with delayed submit.

Example:

<form action="URL" method="GET" name="redirected"></form>
<script>
   setTimeout(function() {
      document.forms.redirected.submit();
   }, 1000);
</script>
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top