Hacker News Reader

Comment by mkjones | Hacker News Reader

Ah yes, I misread your post. The trouble with that approach is that you have to enumerate the dangerous params, and if the actual page URL needs a private parameter to work, you can't get rid of it.

View on HN

Right, but you can always pass the canonical url to the redirector. That lets you avoid maintaining a whitelist/blacklist of query params. This should be trivial for Quora as most of their pages already contain the meta tag specifying the canonical url:

    <link rel="canonical" href="http://www.quora.com/What-are-everyday-apps-that-use-cloud-computing" />

They just need to update their outbound link interceptor to take that version instead of the actual url.

Reply on news.ycombinator.com