top | item 3484732

How not to do URL redirects (… the way Quora does)

72 points| acharekar | 14 years ago |engineering.webengage.com | reply

52 comments

order
[+] kogir|14 years ago|reply
Best I can tell, there is zero incentive for Quora (or any other site, for that matter) to care. Their current redirect logic in no way hurts their user experience.

Right now they protect their users' privacy. What benefit do they realize by providing their users' viewing history to other sites?

I personally think that the referer header was never a good idea. I disable it in my browser, and appreciate sites that do right by their users with privacy protecting default behaviors.

[+] marquis|14 years ago|reply
I think that is does benefit Quora for content providers to see how much traffic is being generated from their site. If I knew an article was getting a lot of traction on a site I would spend more time on there, perhaps participate and continue to improve and generate content itself, thus benefiting Quora with more data and more links for everyone.
[+] avlesh-singh|14 years ago|reply
Of course there is zero incentive for anyone to do it. And if everyone chose to link the way Quora does, you get a Google Analytics dashboard which cannot tell you what all URL's are sending traffic to your site/blog. I find it really difficult to imagine.
[+] yuvadam|14 years ago|reply
I hate to crash the party, but why is the premise that "overriding links is absolutely okay" taken for granted?

Says who? Google and their `/url`? Facebook and their `l.php`?

[+] larrik|14 years ago|reply
Why wouldn't it be okay? This is a link on their own website, they can control it how they want.
[+] zerostar07|14 years ago|reply
Indeed, referers are useful information in some cases. For bookmarking apps like http://noteplz.com one useful thing is that along with the bookmark, they also store the referer, so you can later go back to the google search result where you found that bookmark.

On the other hand, with https and url shorteners,referers are a dying breed. The situation with URL shorteners is absurdly funny now, because twitter double-shortens the shortened urls, since most popular sites have their own shortener.

[+] avlesh-singh|14 years ago|reply
Tracking helps you build great analytics. I, as a developer, would have otherwise no idea of what's happening in my app.
[+] sequoia|14 years ago|reply
This is probably not the case, but is it possible that Quora is intentionally stripping the referer header? Duck Duck Go does just this in the interest of user privacy: why should site X know where I came from and what I was searching? https://duckduckgo.com/privacy.html Seems unlikely in this case but possible.

Incidentally, it seems that encrypted.google.com does this but not regular google. EDIT: This happens for all https->http requests, it's not a google feature (TIL).

[+] jimktrains2|14 years ago|reply
The User-Agent generates the Referrer header, not the site. Also, encrypted.google.com doesn't do it, the HTTPS standard says that browsers shouldn't send referrer headers to sites not in the same domain or not with https.
[+] aerotrain|14 years ago|reply
encrypted.google.com does this because it uses https. If a website is accessed from https and a link points to anywhere except another secure location, then the referrer is not sent.
[+] entropyneur|14 years ago|reply
I don't see how this could be a result of simple mistake. There doesn't seem to be any reason to do redirects this way except hiding the referrer.
[+] acharekar|14 years ago|reply
Exactly what is pointed out in the post. Why would someone want to hide the original referrer for a link.
[+] buddydvd|14 years ago|reply
It's most likely done intentionally to protect against leaking the clicker's identity. See the issue Facebook had back then: http://www.benedelman.org/news/052010-1.html
[+] avlesh-singh|14 years ago|reply
Sending an incorrect site referrer to a downstream website doesn't solve the identity problem! HTTP headers have existed even before all these applications came into being. One just has to abide by some of those basics.
[+] ck2|14 years ago|reply
We let you create surveys and display those on your website in a “targeted” manner

A better title for your article would have been:

why to never rely on referers

(which can be blocked or purposely malformed)

[+] avlesh-singh|14 years ago|reply
Absolutely! The post might have got some attention from Quora in that case :)
[+] gecco|14 years ago|reply
Would we get the right referer if 302 is done via quora redirect?
[+] avlesh-singh|14 years ago|reply
Not sure if I understood this correctly. If Quora chose to send a Location: some-url and Status: 302, it would have definitely worked as expected.
[+] mnutt|14 years ago|reply
Since you are a hosted service, you could periodically loop through all of the Quora redirect links you've received and resolve them. This might be against Quora's TOS, though.

I believe Twitter does this with URL shortener links posted in tweets.

[+] casca|14 years ago|reply
So Quora works for you now? That must be nice...
[+] avlesh-singh|14 years ago|reply
Seems you saw a Quora survey on our site? We had to change the targeting rules to make it a generic "referring site starts with Quora.com" kinda rule instead of specific URL's :(