Re: [referrer] HTTPS->HTTP from Anne van Kesteren on 2014-10-24 (public-webappsec@w3.org from October 2014)

From: Anne van Kesteren <annevk@annevk.nl>
Date: Fri, 24 Oct 2014 08:41:13 +0200
To: Mark Nottingham <mnot@mnot.net>
Cc: WebAppSec WG <public-webappsec@w3.org>
Message-ID: <CADnb78hQ-QafugRAVrWw6F90pNNy2fTewa8oxLqCd3CNFV64dQ@mail.gmail.com>

On Fri, Oct 24, 2014 at 7:29 AM, Mark Nottingham <mnot@mnot.net> wrote:
> Has this been discussed yet?

The main problem with the current setup is that popular properties
such as Google and Twitter use a non-TLS redirect origin so they get
referrer credits. I don't know if a policy of origin would be
sufficient for them however.


-- 
https://annevankesteren.nl/

Received on Friday, 24 October 2014 06:41:40 UTC