diff --git a/Optional-Hardening.md b/Optional-Hardening.md index 8785d7f..f1ffe7b 100644 --- a/Optional-Hardening.md +++ b/Optional-Hardening.md @@ -116,12 +116,15 @@ user_pref("default-browser-agent.enabled", false); *** -### Cross-origin referrer +### Cross-origin referer Do not send a [referer](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer) when navigating to a different site (e.g., `google.com` → `facebook.com`). -For subresources, the referrer will only be sent to subdomains (e.g., `a.example.com` → `b.example.com`). +For subresources, the referer will only be sent to subdomains (e.g., `a.example.com` → `b.example.com`). :warning: This will break Instagram embeds, Bing login, `MangaPill.com`, and some images/videos. :warning: + +At the end of the day, most navigational "tracking" is harmless (i.e., the same for everyone) and effectively blocking cross-site referers just breaks a lot of sites. + ``` // PREF: do not to send a referrer when navigating to a different site user_pref("network.http.referer.XOriginPolicy", 1);