431345 - Google search causes first result to be requested and with HTTP_REFERER [prefetching]

Status: RESOLVED INVALID

(Firefox :: Search, defect)

Description

[Jonathan Zdziarski]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5

This appears to be specific to 3.0, as 2.x and Safari neither have this behavior (which is why I believe it may be browser related, and not site related). When searching google, the very first result that is returned is also queried by the user's browser, and unless HTTP_REFERER is disabled, will show that the user was Googling for a particular site even before they click on it. This may be related to the context lookup for sub-pages which is done on the first result, but if it was specifically related to Google, I'd think other browsers would be behaving this way as well.

Reproducible: Always

Steps to Reproduce:
1. Google your own web server so that it is the first result (or you can google mine "Jonathan Zdziarski" and I'll send you the results)
2. Look in your access log and you will see the site was queried by your browser
3. Panic
Actual Results:  
The site was queried by my browser without even clicking on it, and with a referer

Expected Results:  
No querying done until I click on the link

Comment 1

[Jonathan Zdziarski]

Apparently a new privacy leak, er, feature:

http://kb.mozillazine.org/Network.prefetch-next

Can this be disabled by default? Or perhaps set not to include the referer and/or listed as a privacy issue.

Comment 2

[Jesse Ruderman]

This happens because http://www.google.com/search?q=Jonathan+Zdziarski contains <link rel="prefetch" href="http://www.zdziarski.com/">.  Google is suggesting that browsers prefetch the first result for this query.

I don't know what would cause Firefox 2 to behave differently.

I think sending the referrer with the request is the right thing to do, but I haven't read much of bug 174984.

Comment 3

[Jesse Ruderman]

http://www.google.com/help/features.html#prefetch

Comment 4

[Jonathan Zdziarski]

Without the referer, it's a bandwidth issue at best, or possibly a liability issue in its most extreme circumstance (e.g. a website that instructed your browser to download something illegal, or something tied to a honeypot). 

With the referer, it's borderline privacy leak, at the user has no knowledge that this prefetching is happening. 

I guess what I'm suggesting is that in conjunction with all of these private data options now in Firefox, it seems as if there are at least a handful of settings (including network.prefetch-next) that should be disabled or restricted if privacy settings are enabled.

Comment 5

[Jesse Ruderman]

I don't think this is much of a privacy issue.  It should only happen for queries where Google thinks you're very likely to click the first result.

Comment 6

[:Gavin Sharp [email: [e-mail]]]

As originally filed this is INVALID, given comment #1. Feel free to file a new bug about privacy options or default pref changes.