{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/245","repository_url":"https://api.github.com/repos/whatwg/fetch","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/245/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/245/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/245/events","html_url":"https://github.com/whatwg/fetch/issues/245","id":140279457,"number":245,"title":"referrer same-origin constraint is a footgun for people trying to \"copy\" a Request","user":{"login":"wanderview","id":1256526,"avatar_url":"https://avatars.githubusercontent.com/u/1256526?v=3","gravatar_id":"","url":"https://api.github.com/users/wanderview","html_url":"https://github.com/wanderview","followers_url":"https://api.github.com/users/wanderview/followers","following_url":"https://api.github.com/users/wanderview/following{/other_user}","gists_url":"https://api.github.com/users/wanderview/gists{/gist_id}","starred_url":"https://api.github.com/users/wanderview/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wanderview/subscriptions","organizations_url":"https://api.github.com/users/wanderview/orgs","repos_url":"https://api.github.com/users/wanderview/repos","events_url":"https://api.github.com/users/wanderview/events{/privacy}","received_events_url":"https://api.github.com/users/wanderview/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":44,"created_at":"2016-03-11T20:10:25Z","updated_at":"2016-08-26T11:36:01Z","closed_at":null,"body":"Recently I saw a website in the wild attempting to do this:\r\n\r\n```\r\nvar request(newURL, {\r\n  referrer: oldRequest.referrer,\r\n  // copy other attributes as well\r\n});\r\n```\r\n\r\nThis will work just fine during development on localhost, because .referrer will most likely always be same-origin.  When the site is posted on twitter, for example, it will be visited through a t.co redirector.  This results in a t.co referrer which is cross-origin.\r\n\r\nSo the site that worked fine in local development will blow up when its published to twitter.  This seems like a bit of a footgun.\r\n\r\nWe could make new Request() silently ignore the value if its invalid instead of throwing.  This is somewhat similar to using bad header values.  They just get ignored."},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/242710099","html_url":"https://github.com/whatwg/fetch/issues/245#issuecomment-242710099","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/245","id":242710099,"user":{"login":"RReverser","id":557590,"avatar_url":"https://avatars.githubusercontent.com/u/557590?v=3","gravatar_id":"","url":"https://api.github.com/users/RReverser","html_url":"https://github.com/RReverser","followers_url":"https://api.github.com/users/RReverser/followers","following_url":"https://api.github.com/users/RReverser/following{/other_user}","gists_url":"https://api.github.com/users/RReverser/gists{/gist_id}","starred_url":"https://api.github.com/users/RReverser/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RReverser/subscriptions","organizations_url":"https://api.github.com/users/RReverser/orgs","repos_url":"https://api.github.com/users/RReverser/repos","events_url":"https://api.github.com/users/RReverser/events{/privacy}","received_events_url":"https://api.github.com/users/RReverser/received_events","type":"User","site_admin":false},"created_at":"2016-08-26T11:36:01Z","updated_at":"2016-08-26T11:36:01Z","body":"@annevk Thank you!\r\n\r\n> we'll just silently make it about:client\r\n\r\nAs for this - wouldn't it be possible to preserve referrer but not allow JS to read it for such cases? Or the security concern is different?"}}
{"actor":{"display_login":"RReverser"}}