Does http-equiv="refresh" keep referrer info and metadata?_问答_开发者

Does http-equiv="refresh" keep referrer info and metadata?

开发者 https://www.devze.com 2023-01-02 06:27 出处：网络

开发者_StackOverflow中文版If I set up a page like this: <html><head><meta http-equiv=\"refresh\" content=\"0;url=http://internic.net/\"></head><body></body></ht

开发者_StackOverflow中文版If I set up a page like this:

<html><head><meta http-equiv="refresh" content="0;url=http://internic.net/"></head><body></body></html>

Will the browser send referrer info and other metadata when the redirection is performed?

In testing here, Firefox and IE do not but Chrome does send the referrer (though this is inconsistent as well), regardless of whether it's going to the same domain or not.

Seeing as I can't find any spec stating what should be the standard behavior, and W3C in general discourages a META redirect, I'm not sure you can ever depend on this being consistent.

I did some additional testing with this. I had three URIs involved (all on the same domain):

/page.html which had a link to the meta refresh
/refresh.html which used a meta refresh to the destination
/destination.html which used JavaScript to write the referrer into the page.

I ran the test in several browsers by opening page.html and clicking on the link, then observing what the referrer was on the destination. Here are the results:

Internet Explorer - No referrer
Firefox - No referrer
Chrome - Referrer: http://example.com/refresh.html
Safari - Referrer: http://example.com/refresh.html
Opera - Referrer: http://example.com/refresh.html

None of the browsers showed http://example.com/page.html as the referrer the way that they would with a 301 or 302 redirect. So meta refresh can be used to some extent to obscure the referrer:

Hide the specific page that had the link
Remove the query string from the referrer
If a third party site hosted the refresh, hide the specific site that linked
Remove the external referrer on incoming traffic (useful in situations like this)

Indeed, it's possible to trick Firefox and Internet Explorer, getting the same redirection result, with preserved referrer, by simply using a form with delayed submit.

Example:

<form action="URL" method="GET" name="redirected"></form>
<script>
   setTimeout(function() {
      document.forms.redirected.submit();
   }, 1000);
</script>