Why is there no referer in request headers?

stimw

When I try to set the referer rule against hotlinking, I find that there is no referer in the images in the posts...

This official forum is the same...But I do see some Flarum forums has referer in their images in the posts.

no 'referer' in request headers

Is this related to the version of Flarum or an extension?

stimw

stimw
😢 can anyone help with it?

clarkwinkelmann

stimw please have patience, we have members all over the globe but it doesn't mean we can offer 24/7 support. It can take days for the person that's able to help to be online.

Can you describe the situation in more details? Where/how are the images hosted? Is it cross domain? Is there a public website where we can see it happening?

There are referrer headers and CSP that can affect what is sent along with which request and content type.

Additionally, if you are referring to the FriendsOfFlarum Upload extension, that extension makes internal requests to itself to perform the file download so there's likely no Referrer header when such a request happens. However you might be able to whitelist it based on the fact it comes from the local IP address.

stimw

clarkwinkelmann

Thank you for your reply.

Images are hosted in BackBlaze, and I use fof/upload.
Second-level domain and CDN for the images, so it is cross domain.

Maybe this has nothing to do with that because I use Markdown to insert other image addresses and there is still no referer.

Even this discussion right here (so not only my website...but also here) :

You could check in my website( version:1.0.3): https://unswforum.com/d/19-test-upload

But in this website(still in beta version) images has a referer: https://discuss.flarum.org.cn/d/2643

So I suspect it might have something to do with the Flarum version or a extension?

rob006

Flarum uses same-origin as referrer policy, so browser will not send referrer if image is on different domain. I think it has changed in 1.0.0.

stimw

rob006

So we no longer have the referrer after 1.0.0 if image is on a different domain... 😢

clarkwinkelmann

rob006 that's correct. We now have a middleware that takes care of it https://github.com/flarum/core/blob/v1.0.3/src/Http/Middleware/ReferrerPolicyHeader.php

If you installed Flarum starting with 1.0, you already have a key named headers.referrerPolicy in your config.php that you can edit.

If you have updated from a previous Flarum version, you can add it at the end, for example that's how a new config.php file might look like:

<?php return array (
  'debug' => false,
  'database' => 
  array (
    'driver' => 'mysql',
    'host' => 'localhost',
    'port' => 3306,
    'database' => 'flarum',
    'username' => 'flarum',
    'password' => 'secret',
    'charset' => 'utf8mb4',
    'collation' => 'utf8mb4_unicode_ci',
    'prefix' => '',
    'strict' => false,
    'engine' => NULL,
    'prefix_indexes' => true,
  ),
  'url' => 'https://example.com',
  'paths' => 
  array (
    'api' => 'api',
    'admin' => 'admin',
  ),
  'headers' => 
  array (
    'poweredByHeader' => true,
    'referrerPolicy' => 'same-origin',
  ),
);

rob006

stimw I believe this could be configured, either in config.php or extend.php, but I'm not sure how.

alexkuang0

Set the headers.referrerPolicy field to strict-origin-when-cross-origin if you're trying to enforce hotlink protection, which policy, according to MDN, is the default policy (for browsers?).

Braden

Some will still not understand , here is a better way to explain the syntax

Referrer-Policy: no-referrer
Referrer-Policy: no-referrer-when-downgrade
Referrer-Policy: origin
Referrer-Policy: origin-when-cross-origin
Referrer-Policy: same-origin
Referrer-Policy: strict-origin
Referrer-Policy: strict-origin-when-cross-origin
Referrer-Policy: unsafe-url

no-referrer
The Referer header will be omitted entirely. No referrer information is sent along with requests.

no-referrer-when-downgrade (default)
This is the user agent’s default behavior if no policy is specified. The URL is sent as a referrer when the protocol security level stays the same (HTTP→HTTP, HTTPS→HTTPS), but isn’t sent to a less secure destination (HTTPS→HTTP).

origin
Only send the origin of the document as the referrer in all cases.
The document https://example.com/page.html will send the referrer https://example.com/.

origin-when-cross-origin
Send a full URL when performing a same-origin request, but only send the origin of the document for other cases.

same-origin
A referrer will be sent for same-site origins, but cross-origin requests will contain no referrer information.

strict-origin
Only send the origin of the document as the referrer when the protocol security level stays the same (HTTPS→HTTPS), but don’t send it to a less secure destination (HTTPS→HTTP).

strict-origin-when-cross-origin
Send a full URL when performing a same-origin request, only send the origin when the protocol security level stays the same (HTTPS→HTTPS), and send no header to a less secure destination (HTTPS→HTTP).

unsafe-url
Send a full URL when performing a same-origin or cross-origin request.
This policy will leak origins and paths from TLS-protected resources to insecure origins. Carefully consider the impact of this setting.

davwheat

This is my favourite explanation of it: