INFO: IE Does Not Send Referer Header in Unsecured Situations

• Internet Client SDK, versions 4.0, 4.01
• Microsoft Internet Explorer (Programming), versions 4.0, 4.01

SUMMARY

When linking from one document to another in Internet Explorer 4.0, the HTTP Referer header will not be sent when the referer is a non-HTTP(S) page. The Referer header will also not be sent when linking from an HTTPS page to a non-HTTPS page.

MORE INFORMATION

The Referer header is a standard HTTP header in the form of "Referer: <URL>," which indicates to a Web server the URL of the page that contained the hyperlink to the currently requested URL. When a user clicks on a link on "http://example.microsoft.com/default.htm" to "http://example.microsoft.com/test.htm," the theoretical example.microsoft.com Web server will be sent a referer header of the form "http://example.microsoft.com".

However, Internet Explorer will not send the Referer header in situations that may result in secure data being sent accidentally to unsecured sites. For example, Internet Explorer will not send the Referer header for each of the following example hyperlinks from one document URL to another document URL:

   "javascript:somejavascriptcode" --> "http://example.microsoft.com"
   "file://c:\alocalhtmlfile.htm"  --> "http://example.microsoft.com"
   "https://example.microsoft.com" --> "http://www.microsoft.com"