When linking from one document to another in Internet Explorer 4.0 and later, the
HTTP Referer header will not be sent when the referer is a non-HTTP (or non-HTTPS)
page. The Referer header will also not be sent when linking from an HTTPS
page to a non-HTTPS page.
The Referer header is a standard HTTP header in the form of "Referer:
<URL>," which indicates to a Web server the URL of the page that contained
the hyperlink to the currently requested URL. When a user clicks on a link
on "http://example.microsoft.com/default.htm" to
"http://example.microsoft.com/test.htm," the theoretical
example.microsoft.com Web server will be sent a referer header of the form
"http://example.microsoft.com".
However, Internet Explorer will not send the Referer header in situations
that may result in secure data being sent accidentally to unsecured sites.
For example, Internet Explorer will not send the Referer header for each
of the following example hyperlinks from one document URL to another
document URL:
javascript:somejavascriptcode --> http://example.microsoft.com
file://c:\alocalhtmlfile.htm --> http://example.microsoft.com
https://example.microsoft.com --> http://www.microsoft.com
This prevents local file names from being sent inadvertently to Web servers
when linking from local content to Web sites that might snoop on such
information. Also, many secure (HTTPS) Web servers store secure information
such as credit-card data in the URL during a GET request to a CGI or ISAPI
server application. This information can be unwittingly sent in the
Referer header when linking out of an "https://" server to an "http://"
server elsewhere on the Web. Internet Explorer attempts to prevent this bad
practice by not sending the Referer header when transitioning from an
HTTPS URL to a non-HTTPS URL.
Help and Support
Back to the top
