User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.125 Safari/533.4 Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:126.96.36.199) Gecko/20100625 Firefox/3.6.6 All http in the browser send a referrer header, except the new video, source and audio elements. This means that we can't prevent someone from hotlinking the content from a site by using a simple referral check technique. This recently took down my server because a very high traffic site was linking directly to the video and the server couldn't cope. I should have been able to prevent it from continuing by preventing hotlinking, but there's no referrer header being sent (all other headers are fine). Opera does this correctly and sends the headers. The result was I had to remove the video entirely from http://html5demos.com/video Reproducible: Always Steps to Reproduce: Run this HTML and inspect the request headers in Firebug - a plain image and script are there for reference: <!DOCTYPE html> <title>video refer test</title> <body> <img src="image-for-reference" /> <video src="video-via-src-attribute"></video> <video> <source src="video-via-src-element"></source> </video> <script src="script-for-reference"></script> </body> Actual Results: No referrer headers on the video, but we do have them on the image and script. Expected Results: Correct referrers for media elements.
This is a valid bug and an important anti-abuse feature as described above.
Created attachment 465058 [details] [diff] [review] Send Referer header with media requests
Comment on attachment 465058 [details] [diff] [review] Send Referer header with media requests Could use a test
Created attachment 475592 [details] [diff] [review] Test that referer is sent For the test I have an sjs that checks the referer. If it exists then it returns a video otherwise it returns a 404.
The test is only going to work if Ogg is enabled. I think you could take the filename as a query parameter in the URL, then the test JS can select a file name that's supported and pass that to the sjs.
Yeah I did it this way because we took the same approach in another bug after discussion that we always have ogg enabled in our test machines.
I'll change it to not need any specific backend.
Created attachment 475705 [details] [diff] [review] Test that referer is sent Changes test to iterate through one of the manifest list of files, looks for only those we can play and tests referer on them.
Created attachment 475898 [details] [diff] [review] Rolled up and rebased patch Rolled up patch and rebased to trunk. Carried r+ forward.