Auto Referer

Control HTTP Referer to protect privacy and not break web. Open source at https://github.com/garywill/autoReferer

Referer policy:

1. For webs' top frame (i.e. clicking link, navigating, redirecting etc.): 1). If origin and target url have same domain, allow trimmed referer 2). If origin and target url have different domain, no referer

2. For in-page resources (images, videos, js, css etc.), allow trimmed referer (this is the key to not break most webs, also a balance between privacy and experience)

3. Trim referer: Any referer should be no more than http(s)://domain-name:port/

4. Not allow referer that not starts with "http" or "https". (Please feedback if you find something broken due to this)

5. No referer when downgrade from HTTPS/WSS to HTTP/WS

We believe that can protect privacy enough and won't break web.

If user find a web broken, user can temporary set this addon disabled via toolbar button for:

• this one tab
• this one tab and new tabs opened by this tab
• this one window (Firefox only)
• globally

(above can be set as keyboard shortcuts)

there's showy toolbar button badge indicating disabling status.

Notice

Due to browser bug on javascript document.referrer , using a regular referer controlling addon you can get 70% of expected protection until they fix that bug.

So, we've implemented a workaround to improve protection to 85%. Please enable workaround in addon settings .

This addon doesn't use content script. Content script hiding document.referrer is not 100% reliable.

Instead, we use this workaround to kill document.referrer: Cancel all cross-domain navigating requests and make freshnew ones, like directly hit (currently only implemented for GET method and main frame, other methods and sub-frames remain as is)

Allowlist

We currently have built-in allowlist, for the purpose of not breaking some websites. Some companies have many different websites with different domains. Some of their functionality are based on redirecting between their websites. Some of them check referer.

Disclaimer

This open souce addon comes with no warranty. Use on you own risk!