meta referrer is not working when loading images
Reported by
yaoli111...@gmail.com,
Dec 28 2017
|
||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Steps to reproduce the problem: 1. My website is hosted under https, while the pages load images from http url. So the images request will not bring the "referrer" head. 2. According to the docs, I set the meta: <meta name="referrer" content="origin-when-cross-origin"> 3. It works when the pages download the other resources, but not works for images. What is the expected behavior? the images request head contains referrer. What went wrong? the images request head does not contain referrer, while firefox is working. Did this work before? No Chrome version: 63.0.3239.84 Channel: n/a OS Version: OS X 10.12.6 Flash Version:
,
Dec 28 2017
,
Jan 1 2018
"Thanks for filing the issue! @Reporter: Could you please share a sample test URL/file which helps us to triage the issue in a better way."
,
Jan 1 2018
I'm not able to reproduce a problem in Chrome 63 or Chrome 65. Test page: https://bayden.com/test/refer/meta-origin.htm
,
Jan 2 2018
I just tested your demo, It looks good, thank you. And I tried again on my project, it looks weird. After I add the meta <meta name="referrer" content="origin">, the image request header can be different under different scenarios. case 1: if the page downloads image through static html dom, like <image src="my_image_path" /> , it works that image request header brings referrer header. In this case, it is as same as your demo. case 2: If the page downloads the image dynamically through JS script when the page is first downloaded, it does not work that the image request header does not bring the referrer header case 3: If the page downloads the image dynamically through JS script after I click the dom or manipulate the page manually, it works. The iamge request header will bring referrer header
,
Jan 2 2018
Thank you for providing more feedback. Adding requester "vamshi.kommuri@techmahindra.com" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 2 2018
can you attach an example for case 2 & 3 please?
,
Jan 8 2018
marking as wontfix for now. please reopen with repro instructions if this is still relevant |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by elawrence@chromium.org
, Dec 28 2017Components: Blink>SecurityFeature>Referrer
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug