1928291 - Enable network.http.referer.sendFromRefresh in all channels.

Status: RESOLVED FIXED

(Core :: DOM: Navigation, enhancement)

Comment 1

[Tess Hoffman [:zrhoffman]]

Attachment: Bug 1928291 - Enable sending Referer header from Refresh by default. r=smaug!,peterv!,#dom-core

Intent to ship:

https://groups.google.com/a/mozilla.org/g/dev-platform/c/Eohf1MXoaT4

Comment 2

[Tess Hoffman [:zrhoffman]]

https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy could maybe benefit from an example of a Refresh with Referrer Policy.

Here is a <meta> refresh navigation with the origin referrer policy: https://wpt.live/referrer-policy/generic/resources/refresh-policy.sub.html?policy=origin&url=referrer-info.sub.html

And here is a Refresh header navigation with the origin-when-cross-origin referrer policy: https://wpt.live/referrer-policy/generic/resources/refresh-policy.py?policy=origin-when-cross-origin&url=referrer-info.sub.html

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/663aae7da91a
Enable sending Referer header from Refresh by default. r=smaug,peterv,dom-core

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/663aae7da91a

Comment 5

[Donal Meehan [:dmeehan]]

:zrhoffman could you consider nominating this for a release note? (Process info)

Comment 6

[Tess Hoffman [:zrhoffman]]

Release Note Request (optional, but appreciated)
[Why is this notable]: It resolves web compat issues affecting popular sites like Twitch.
[Affects Firefox for Android]: Yes
[Suggested wording]: Firefox sends a referrer from meta refreshes and Refresh headers.
[Links (documentation, blog post, etc)]:
Intent to ship: https://groups.google.com/a/mozilla.org/g/dev-platform/c/E_fGBCm0NrQ
Spec: https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives:navigate

Comment 7

[Donal Meehan [:dmeehan]]

Thanks, added to the Fx136 nightly release notes, please allow 30 minutes for the site to update.
Keeping the relnote-firefox flag as ? to keep it on the radar for inclusion in the final Fx136 release notes.

Comment 8

[Hamish Willee]

FF136 MDN docs for this can be tracked in https://github.com/mdn/content/issues/37944

My understanding is

• a refresh can be caused by the Refresh header, or the meta <meta http-equiv="refresh" content="..."> (where content might specify the URL) and will cause browser to refresh the current page or redirect to a new URL after time.

• A Referer header should be included requests depending on a policy, which may be specified in lots of ways (but notably by the Referrer-Policy header).

• For the case of refresh, prior to this change, it is not (every) being included in the request to get the same page again or the redirect page. Right?

• After this change the refresh header will be sent in requests, provided this is allowed by the referrer-policy of the originating page.

• Above you say

  "https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy could maybe benefit from an example of a Refresh with Referrer Policy."

  Were you thinking of a heading saying exactly "Refresh with a referrer policy" showing the appropriate meta tags?

Can you confirm. I want to make sure I've got this correct before I start any docs.

Comment 9

[Tess Hoffman [:zrhoffman]]

(In reply to Hamish Willee from comment #8)

• a refresh can be caused by the Refresh header, or the meta <meta http-equiv="refresh" content="..."> (where content might specify the URL) and will cause browser to refresh the current page or redirect to a new URL after time.

Right

• A Referer header should be included requests depending on a policy, which may be specified in lots of ways (but notably by the Referrer-Policy header).

Right

• For the case of refresh, prior to this change, it is not (every) being included in the request to get the same page again or the redirect page. Right?

Right, for the case of refresh, a referrer was not ever being included in the request prior to this change.

• After this change the refresh header will be sent in requests, provided this is allowed by the referrer-policy of the originating page.

Usually right (and document.referrer will be set to that value). The one exception is same-page refreshes (refreshing to a #fragment):

In Firefox, same-page refreshes are not affect by referrer policy and do not change the referrer. However, in Chrome and Safari, they do (this interop difference is up for discussion in https://github.com/whatwg/html/issues/6451).

Example: https://wpt.live/html/browsers/browsing-the-web/navigating-across-documents/refresh/resources/refresh-with-section.sub.html?url=%23section

• Above you say

  "https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy could maybe benefit from an example of a Refresh with Referrer Policy."

  Were you thinking of a heading saying exactly "Refresh with a referrer policy" showing the appropriate meta tags?

That sounds good, thanks! And maybe there could be notes on https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Refresh and https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta that link to it?

Comment 10

[Tess Hoffman [:zrhoffman]]

From https://www.mozilla.org/en-US/firefox/136.0a1/releasenotes/#note-790638:

Firefox now sends a referrer rom meta refreshes and Refresh headers.

s/rom/from/ :)

Comment 11

[Hamish Willee]

Thanks very much Zach!

FYI In addition to the release note, I ended up adding notes to Refresh and Referrer headers in https://github.com/mdn/content/pull/38190 on the basis that this is where you might look as a reader to understand when the referrer might be sent.

I didn't include a note in the Referrer-Policy doc for the same reason - the policy might prevent information being included in the referer after a refresh, but I don't think people would check it to find out what is going on "first". It also doesn't fit with the other information in that page. You might have other reasons for suggesting this that I've missed - in which case, perhaps propose some text.

Note also that I didn't add any detail on the same-page refresh compatibility issue. That doesn't seem to be causing the same level of problem for users, and it can wait until there is a resolution of the compat issue.