curben
/
blog
mirror of https://gitlab.com/curben/blog
1
0
Fork 0
Code Issues Releases Wiki Activity

post: 'GitHub now requires web browser to send referer'

This commit is contained in:
curben 2019-12-08 02:48:35 +00:00
parent 88fcd4c8e6
commit 1c89559326
No known key found for this signature in database
GPG Key ID: 5D9DB57A25D34EE3
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
source/_posts/github-referer-firefox.md Normal file
View File

@ -0,0 +1,14 @@
---
title: GitHub now requires web browser to send referer
excerpt: Otherwise it would respond with HTTP Error 422
date: 2019-12-08
tags:
- firefox
- privacy
---
Firefox offers a security feature which you can restrict [HTTP referer](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer) from being sent with varying granularity ([docs](https://wiki.mozilla.org/Security/Referrer)). I disabled referer altogether through `network.http.referer.defaultPolicy;0`. Most of the websites that I usually browse work just fine without referer. For website that do require ({% post_link aliexpress-no-login-firefox 'example' %}), I created {% post_link firefox-instances-profiles 'another profile' %} with slightly less strict referer policies.
A website that had always worked without referer was GitHub, until 26 October 2019. At that time, I kept encountering HTTP Error 422 whenever I try to create a new pull request (the [pull request](https://github.com/hexojs/hexo/pull/3800) in question). I later pinpointed the cause to be the referer policy after I managed to create pull request in another Firefox profile and Chromium, that do not have any referer policy in place. I ended up with [duplicate](https://github.com/hexojs/hexo/pull/3801) [pull](https://github.com/hexojs/hexo/pull/3802) requests in the process.
The referer policy I ended up is ``network.http.referer.defaultPolicy;1` (default is `3`) which restricts the referer to the same origin only. This config is compatible with *every* website I've encountered so far, including those that require referer. One thing to note is that website can set referer policy through [Referrer-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) response header. But a website can only set it to the same or more strict than browser's. For this website, I set it `no-referrer`, the strictest setting equivalent to `network.http.referer.defaultPolicy;0`.