Bug 234511 - Open Link in New Tab does not send referer header
Summary: Open Link in New Tab does not send referer header
Status: RESOLVED MOVED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: Safari 15
Hardware: Mac (Intel) macOS 11
: P2 Normal
Assignee: Nobody
URL: https://mskelton.github.io/chromium-bug
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-12-20 06:35 PST by mskelton@widen.com
Modified: 2022-02-10 08:47 PST (History)
5 users (show)

See Also:


Attachments
Screencast showing requests and missing referer header (28.88 MB, video/quicktime)
2021-12-20 06:35 PST, mskelton@widen.com
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description mskelton@widen.com 2021-12-20 06:35:04 PST
Created attachment 447600 [details]
Screencast showing requests and missing referer header

When opening links in a new tab, the Referer header is not sent.

Steps to reproduce the problem:

1. Go to https://mskelton.github.io/chromium-bug
2. Right click on GitHub link
3. Click Open Link in New Tab
4. Notice that the Referer header is missing in the request

This occurs both for cmd+click and right click -> Open in New Tab and is the case for both same origin and cross origin links.
Comment 1 Radar WebKit Bug Importer 2021-12-27 06:36:23 PST
<rdar://problem/86937817>
Comment 2 Chris Dumez 2022-01-04 10:35:19 PST
It is not clear to me here that this is a bug and that we are expected to send a referrer header here.

How is that different from copying the link URL, opening a new tab and pasting the URL in the URL bar (which is basically what this menu action does)?
Comment 3 mskelton@widen.com 2022-01-04 11:03:42 PST
(In reply to Chris Dumez from comment #2)
> It is not clear to me here that this is a bug and that we are expected to
> send a referrer header here.
> 
> How is that different from copying the link URL, opening a new tab and
> pasting the URL in the URL bar (which is basically what this menu action
> does)?

Other browsers correctly attach the Referer header when opening links in a new tab (save for a minor bug in Chrome) so I would hope Webkit would follow suit to be consistent.
Comment 4 Chris Dumez 2022-01-04 11:45:03 PST
(In reply to Mark Skelton from comment #3)
> (In reply to Chris Dumez from comment #2)
> > It is not clear to me here that this is a bug and that we are expected to
> > send a referrer header here.
> > 
> > How is that different from copying the link URL, opening a new tab and
> > pasting the URL in the URL bar (which is basically what this menu action
> > does)?
> 
> Other browsers correctly attach the Referer header when opening links in a
> new tab (save for a minor bug in Chrome) so I would hope Webkit would follow
> suit to be consistent.

Yes, if other browsers do so, it is pretty good justification for us to do the same indeed.
Comment 5 Chris Dumez 2022-01-04 14:53:54 PST
Ok, here is a better test repro:
- https://codepen.io/cdumez/pen/poWKzxV

1. Right-click link > open in new tab
2. Notice that there is no referrer printed out in Safari but there is one in both Chrome and Firefox.
Comment 6 Chris Dumez 2022-01-04 15:05:55 PST
(In reply to Chris Dumez from comment #5)
> Ok, here is a better test repro:
> - https://codepen.io/cdumez/pen/poWKzxV
> 
> 1. Right-click link > open in new tab
> 2. Notice that there is no referrer printed out in Safari but there is one
> in both Chrome and Firefox.

This appears to be a Safari issue though, not a WebKit one. If I use WebKit's mini browser and click "open in new window", then I see a referrer.

The problem is that Safari hijacks the context menu and has its own actions in there. Those "Open Link in..." actions do not send a referrer header.
Comment 7 Brent Fulgham 2022-02-10 08:45:51 PST
This is actually:
<rdar://3413260>

It is apparently standard Safari behavior since 2003.
Comment 8 Brent Fulgham 2022-02-10 08:47:39 PST
Mark: Just to be clear, you are reporting a problem in the Safari client of WebKit, which chooses to implement its own 'Open Link In' behavior that does not include the header.

I am resolving this as 'Moved', since it needs to be fixed in the Safari client. That problem is tracked in Safari under rdar://3413260.