{"push_id":1192970056,"size":1,"distinct_size":1,"ref":"refs/heads/strip-referer-from-groups-page-links","head":"85a5b677967b6d164d088f9be3e82ac41713ba20","before":"d0046a9f89407c55f73b1481eeb853afc48e1251","commits":[{"sha":"85a5b677967b6d164d088f9be3e82ac41713ba20","author":{"name":"Sean Hammond","email":"5bf00c93c9250d44d769b81890fa6584403ae7e0@snhmnd.fastmail.com"},"message":"Remove referer from groups page links\n\nAsk browsers not to include path part of the URL in the HTTP \"Referer\"\nheader in requests sent when clicking on links on the groups page, by\nadding a <meta name=\"referrer\" content=\"origin\"> HTML tag to the <head>\nof the groups page.\n\nThe problem is that some of the links on a group's page - the links to\nthe documents that the group has annotated - are links to third-party\nwebsites and the values of the Referer header sent to these websites\nwould be the URLs of the group pages.\n\nIf you have the URL of a group's page then you can join the group and\nsee the group's annotations, and those URLs were being revealed to\nanyone with access to the HTTP request logs of the servers of the\nannotated documents.\n\nThe <meta name=\"referrer\" tag actually asks browsers not to send the\npath for _any_ of the links on the page, including links to other pages\nof our own hypothes.is website, even though it's only the links to\nthird-party sites that we don't want to send the path to.\n\nOther possible fixes that were rejected:\n\n- A `Referrer-Policy: origin` HTTP header does the same thing as the\n  <meta name=\"referrer\" content=\"origin\"> tag and would be a nicer way\n  to do it, but none of Chrome, Firefox, Safari or Edge support the\n  Referrer-Policy header (I tested it in Chrome and it didn't seem to\n  work, the FastMail blog post linked below states that it doesn't work\n  in the other browsers either).\n\n- It's possible to add a rel=\"noreferrer\" attribute to individual links,\n  instead of a <meta name=\"referrer\" tag for the whole page, but\n  rel=\"noreferrer\" is not as widely supported by browsers as <meta\n  name=\"referrer\" is (in particular, rel=\"noreferrer\" is not supported\n  by older versions of Firefox or by any version of Internet Explorer).\n\n- It's also possible to use a\n  <meta name=\"referrer\" content=\"origin-when-cross-origin\"> tag to tell\n  the browser to only send the path in the Referer when following links\n  to URLs of the same origin as the current page. But\n  \"origin-when-cross-origin\" is not as widely supported by browsers as\n  \"origin\" (in particular, Edge and Safari don't support it).\n\nSince we're not actually doing anything with the path in the Referer\nheader when people follow links from the groups page to other pages of\nour own site, I judged it better to go for the widest browser support\nthan to try to only strip the path from the links that we need to strip\nit from.\n\nFor further reading about stripping Referer see:\n\nhttps://blog.fastmail.com/2016/06/20/everything-you-could-ever-want-to-know-and-more-about-controlling-the-referer-header/\n\nOther approaches that were considered:\n\n* A link from a group's page to https://example.com/annotated_document\n  could link to https://hypothes.is/redirect/https://example.com/annotated_document,\n  this /redirect/* page would then simply issue an HTTP redirect to the\n  given *. Unfortunately this doesn't work: browsers preserve the\n  original Referer when HTTP-redirected.\n\n* You can do tricks with JavaScript redirects, falling back to HTML (not\n  HTTP) redirects when JavaScript isn't available, but browser behaviour\n  with the various available techniques varies between browsers and it\n  seems complicated and hacky.\n\n* The links to documents on the group's page could become bouncer direct\n  links. Bouncer seems to strip Referer headers (at least in Chrome).\n  But we don't support direct linking to a group's annotations of a\n  document (as opposed to an individual annotation yet). Also stripping\n  Referer is arguably a bug / unwanted behaviour in bouncer.\n\n* Use separate pages with different URLs for:\n\n  1. The invite link that you need in order to join a group, and\n  2. The page that you visit to see what a group has been doing when\n     you're already a member of the group\n\n  1 would be the secret link needed to join the group, and would not contain\n  any links to third-party sites.\n\n  2 would contain the links to the annotated documents, but would not\n  contain the secret code in the URL.\n\n  This seems like it might be a good approach, but is a lot more work\n  than just inserting a <meta> tag.\n\n* Have a proper group invite system that doesn't rely on a secret URL.\n  Again, too much work for now.","distinct":true,"url":"https://api.github.com/repos/hypothesis/h/commits/85a5b677967b6d164d088f9be3e82ac41713ba20"}]}
{"actor":{"display_login":"seanh"}}