today I was a bit surprised to see a <link rel="canonical">-Tag in action:

I was reading this news article on my android phone and wanted to share it:


But I noticed that instead of this original link, it copied/shared the link from the <link rel="canonical">-Tag. This URL points to a completly different server!

I tried to reproduce this on a desktop browser, but these browsers seem to share the original URL, which is the IMHO expected behaviour.

I consider this behavior as potentially harmful, because a through this, a website could make me share different content than I wanted to share without even noticing it - a product website could make me share a more expensive product, a news website could make me share another opinion.

What do you think? It the behavior of chrome on android correct? Is this a know security issue?

  • 1
    I don't see any new attack vector here. Even if you share the original link the site could display different content to a different user for the same URL. There is no need to use canonical links for this. It is unexpected though that the canonical link points to a completely different site which is out of control of the original server. I don't think that canonical links were supposed to be used like this. – Steffen Ullrich Nov 16 '18 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.