Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Circumventing that filter is easy for the user, but I don't see how it's easy for the referring website.


A referrer is not sent when following a link from a secure website (https) to a non-secure website.

http://tools.ietf.org/html/rfc2616#section-15.1.3


Thanks for the information. I had not realised that. There are still plenty of other measure that Ryanair could use, of course, in the case where there was no Referer: header, such putting some unique (and constantly changing) id into a cookie such that links from another site wouldn't have the correct id. As other have suggested, perhaps they are perfectly happy with most deep links into their site, just not from certain sites such as price comparison sites. Far be it from me to speculate about such things, of course.


I would assume that the filter would be implemented to deny/redirect the request if there were no referrer at all.


From context, I assumed we were talking about users following deep links. This can be prevented technologically by the target website, and the burden of circumvention is obviously on the user.

Obviously there is no technological way to prevent "deep linking" by the referring website, because that is just creating an <a> tag.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: