What are the security advantage of new redirecting method used by Gmail and Facebook?

Question

When clicking on the any link in gmail or Facebook,it redirect to that link by some other ways. What are the security advantage of new redirecting method used by gmail and Facebook?

Answer 1

This has nothing to do with security, really. It's about statistics and advertising.

When you put in a link like this:

http://example.com/foo.bar

You get this:

http://www.facebook.com/l.php?u=http%3A%2F%2Fexample.com%2Ffoo.bar&h=<hash>

So, when you click the link, l.php verifies that the h parameter matches the u parameter for security purposes, otherwise it's an open redirection flaw.

The script then logs that you clicked the link. This allows Facebook to get information about how you interact with their service, e.g. Alice shared a link, which Bob and Eve clicked. It also allows them to identify topics you're talking about, even when sending links to each other, for improved ad relevance.

As Hans mentioned, the other part of this is to preserve privacy. When clicking a link, the target server is told, by the browser, which page you were linked from. If you clicked the link whilst viewing Facebook, this might leak your identity or the identity of one of your friends to the target site.

Answer 2

There are two reasons for the intermediate page:

• It prevents sensitive information in the url of the current page to leak to the other side in the "Refer" header because the Refer-header will now contain the url of the intermediate page only.
• It allows the email or social media provider to track clicks. They use this information for spam rating and might use it to increase their knowledge about your interests.