today I was a bit surprised to see a <link rel="canonical">-Tag in action:

I was reading this news article on my android phone and wanted to share it:


But I noticed that instead of this original link, it copied/shared the link from the <link rel="canonical">-Tag. This URL points to a completly different server!

I tried to reproduce this on a desktop browser, but these browsers seem to share the original URL, which is the IMHO expected behaviour.

I consider this behavior as potentially harmful, because a through this, a website could make me share different content than I wanted to share without even noticing it - a product website could make me share a more expensive product, a news website could make me share another opinion.

What do you think? It the behavior of chrome on android correct? Is this a know security issue?

  • 1
    I don't see any new attack vector here. Even if you share the original link the site could display different content to a different user for the same URL. There is no need to use canonical links for this. It is unexpected though that the canonical link points to a completely different site which is out of control of the original server. I don't think that canonical links were supposed to be used like this. – Steffen Ullrich Nov 16 '18 at 19:21

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.