Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Assuming a secured page https://google.com/redirect.php?keyword=apple which redirects the visitor to a non-secured website http://apple.com, would an eavesdropper (anyone watching over the network) be able to see the keyword "apple" from the referer URL?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

In your specific example Google are hiding the referer from click throughs from the results when Google is accessed via HTTPS, and have been for some time.

Non specifically, browsers should not send referrer from https to http but it's possible that some browser implementations do - so the answer to your question is "probably not".

share|improve this answer
    
Thanks a lot for the reference (and explaining it), the second part is what I was looking for. –  Quimp Sep 27 '13 at 1:29

No. Browsers specifically block the Referer header when the transition is from HTTPS to HTTP.

(HTTPS to HTTPS is fine, though following results from Google is a special case: depending on browser, interface type and wind direction, Google may be fiddling with the displayed URL and doing a search without a re-navigation, in which case you may only see https://www.google.com/ and no search term even from an HTTPS site.)

share|improve this answer

Yes and no.

When you visit a non-secured site from HTTP over TLS (i.e. HTTPS), that non-secured site may get the referer line (depending on the web browser), which could contain a keyword from a search engine site.

However, in this specific example with Google, the actual keywords searched is hidden. Using Firefox, the referer line in your http request to apple.com might look something like this (tried this myself using Firefox 24.0):

Referer: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCoQFjAA&url=http%3A%2F%2Fwww.apple.com%2F&ei=jHRCUsGzFZKgqwGoh4CYBg&usg=AFQjCNHos2nRvNTI53JsNNDhfG6TCvPUGw&bvm=bv.53077864,d.aWM

You may want to check this out: http://webmasters.stackexchange.com/questions/44879/not-provided-keywords-from-google-search-if-your-site-uses-https-does-google

Since the exact keywords used is not easy to determine, Apple.com's best source for information of this nature would be through the Google Analytics service.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.