13 ms·

Good shout. Can always block based on origin header though (when under the assumption that it's a legit browser) since it's a forbidden header name. https://de

Good shout. Can always block based on origin header though (when under the assumption that it's a legit browser) since it's a forbidden header name. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or...

gruez 2y ago
I just tested on firefox and it doesn't send the "Origin" header when using referrerpolicy="no-referrer". It's also not present when navigating using the url bar directly.
kbolino 2y ago
Neither the Origin nor the Referer headers have anything to do with a 301 redirect.