Hacker News Reader

Comment by dewiz | Hacker News Reader

Client HTTP header I don't want:

  * referer
  * user-agent

Happy to be wrong, but these shouldn't be mandatory to browse the web, which they kind of are.

View on HN

I too would like a world where all browsers implemented fully the same standard but that's not how it worked out (or it ever works).

This is an amusing (scary?) article about the history of the user-agent:

https://webaim.org/blog/user-agent-string-history/

Yes but you should be testing browser capabilities not user agents.

Totally agree.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Browser_de...

The requires more steps and a slower process. User-agent is a one step process. Browser capabilities means returning something back to the browser and potentially coming back to the server.

While it has obviously been abused, neither way is ideal. There's no way for a server to say "tell me the browser capabilities before I serve you the request".

Note: I've also written about this on my site with more notes and context:

https://jaytaylor.com/writeups/2018/why-referrer-header-empt...

Short version:

These days the referrer header rarely makes it through for 2 main classes of reasons [0].

1. Requests transiting across HTTP <-> HTTPS boundaries do not include the referrer header.

2. The referrer header is frequently disabled by sites (especially search engines and high-traffic sites) through the use a special HTML header meta control tag [1]:

    <meta name="referrer" content="no-referrer" />

Worry not, though. When client-side Javascript is enabled, ga.js still sends enough information that Google can reconstruct most of everyone's browsing sessions on their backend. Now Google (and only Google) really has all your / our data (generally speaking). :-\

[1] https://stackoverflow.com/questions/6880659/in-what-cases-wi...

[0] https://stackoverflow.com/questions/6817595/remove-http-refe...

> ga.js still sends enough information that Google can reconstruct most of everyone's browsing sessions on their backend.

Every time someone asks me to add GA to a website I get a little bit more bitter.

I used to spoof my user-agent and don't remember much of a difference... As a dev, everyone tells me I should just throw literally every possible version of newer attributes into the CSS anyhow, so on most websites you're bound to get at least some of the right ones.

Perhaps your complaint is of a higher order though? Recently I've been spending most of my time wrestling with CSS so my perspective is a bit skewed...

I would be happy to do the same but there's just some browser bugs I have to fix by reading the User-Agent...

for instance, just found today that GitHub code reviews require the Referer header to allow PR comments. Without the Referer header, GH returns `422 Unprocessable Entity`

Reply on news.ycombinator.com