Open.window() Document.referrer from HTTPS site to HTTP site empty

Question

Site1.com offers the possibility to open Site2.com in another window through a button. Site2.com checks document.referrer. As long as Site1.com and Site2.com are using HTTP everything works fine, and the referrer attribute contains the URL of Site1.com.

If Site1.com runs with SSL (https://site1.com), but Site2.com doesn't, the referrer is suddenly empty.

JS Client code on https://site1.com

window.open("http://site2.com", "mySite2.com")

The Site2.com checks the referrer in the JS client code by:

document.referrer

Which turns out to be empty.

My Question: Is this a Javascript problem or an Nginx problem? Why is the referrer empty when using HTTPS on Site1.com ?

Again, if both sites are using HTTP, everything works just fine. The referrer just doesn't get passed on the Site2.com is Site1.com is using HTTPS.

Answer 1

Neither. It is browsers security policy. They do not send referrer when go from secure site to non-secure.

Answer 2

According to HTTP 1.1 protocol.

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure

Here is the policy.

You can not referrer on https to site using http. Referrer will get from

https to https or http to https.