Firefox addon to manage referer?

Questions
1

I searched the forum but got no conclusive (and recent) answer, so can you help me to decide? LLMs gives me completely hallucinated or derailed suggestions…

I am using Firefox on Linux (Debian with XFCE), and Firefox Mobile Beta on Graphene OS, ideally I would like a solution working for both but desktop is priority.

How do you folks manage referers?

I don’t care about all the good reasons why referers exist, I don’t want this on my browser, not even for top-level domains, except for very specific use cases. So I would like a way to only allow referer for certain websites.

My ideal solution would be a FIrefox built-in allowlist like e.g. for cookies, but I cannot influence this.

My second ideal solution would be an extension to manage referer allowlists. My third solution would be an extension to switch referer on/off with a quick UI.

But these extensions should have permissions for all websites, so they are dangerous, I would only trust them if coming from a very reputable source.

I could write my own but I’d rather avoid if I can.

My least favourite option is to have different Firefox profiles for this (I have done this on Desktop, but how to do it on mobile?)

Any pick?

In general, what’s the community sentiment about referers? I’d happily turn them off completely, but some services I use won’t work without.

2

If you want to use only builtin options, you could decide on having your regular session and your private browsing session have different levels of referer trimming.

3

Yes, it’s an option, I would prefer to avoid this solution though. I’d be fine with an extension were it coming from someone trusted. I find it a bit surprising that referer switching is not a thing.

4

Just add a list to uBlock Origin. They are a few one. I think AdGuard has one. You should be able to find it.

5

I use uBlock Origin of course, it would be great if there were a way to set per-site referrer rules from there! Is this the case? Do you know how to do that?

6

There is “Actually Legitimate URL shortener tool”. Link on PG page of extension. Browser Extensions - Privacy Guides

Now, you can’t really pick and choose which websites you want. You could exempt some sites but I am not sure how. The list above already exempts site where it causes breakage.

I advise you to check this page from the Arkenfox Wiki https://github.com/arkenfox/user.js/wiki/4.1-Extensions/

It seems to be down right now, but it has a few lists you might consider.

Something that might be closer to what you are looking for is the ClearURLs extension . I don’t know if it actually has exemptions. The ClearURLs list is also available as a uBlock Origin list, ported by DandelionSprout, the same author as the the ‘Actually Legitimate’ list. (Do not combine the two https://raw.githubusercontent.com/DandelionSprout/adfilt/master/ClearURLs%20for%20uBo/clear_urls_uboified.txt

7

Just to be clear: I am not talking about tracking URL. I am talking about this: HTTP referer - Wikipedia

8

I would not recommend using addons, but rather the builtin config instead (article updated 8 years ago, possibly outdated). Site specific settings are not possible this way.
Firefox already trims cross-origin headers, so for example websites opened from a DDG search will not see the referer’s full query https://duckduckgo.com/?q=foo, but instead only the domain https://duckduckgo.com/
Completely disabling referers will break some pages (login flows / media players in rare cases). To avoid that you could set network.http.referer.XOriginPolicy to 1 in about:config (or chrome://geckoview/content/config.xhtml for Firefox Android) so the referer is only sent if base domains match.

9

Maybe I was not entirely clear.

I know that I could set the option in about:config to disable referer, but as you say this breaks too many websites, this is why ideally I would like a whitelist. If this is not possible, at least a toggle: enable/disable network.http.referer.XOriginPolicy with one click.

I know that, by default, browsers trim cross-origin headers. Still, I consider this an unacceptable privacy policy: why, if I visit https://www.uspto.gov/ this website should be informed that I come from https://www.pornhub.com/ ? I find this completely bonkers!

So, I guess my question is: nobody here seems to care too much?

10

I wasn’t going to respond but changed my mind. I won’t use any browsers unless the referrer doesn’t report where I came from. I don’t use extensions to change referrers because it increases fingerprinting, etc.. These are the best settings that shouldn’t break web sites. So here’s my answer, take it or leave it.

Firefox about:config

// Control when to send a cross-origin referer
// * 0=always (default), 1=only if base domains match, 2=only if hosts match
user_pref(“network.http.referer.XOriginPolicy”, 1);

// Control the amount of cross-origin information to send [FF52+]
// 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port
user_pref(“network.http.referer.XOriginTrimmingPolicy”, 2);

// Set the default Referrer Policy [FF59+]
// 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade
user_pref(“network.http.referer.defaultPolicy.trackers”, 1);
user_pref(“network.http.referer.defaultPolicy.trackers.pbmode”, 1);

With just these four settings, every website you visit will either show no referrer or the referrer will be the website you’re visiting. It will never show where you came from. Any other settings in about:config about the referrer should be set to default settings. Only these four need to be changed. To test it, search for ‘What is my referer’ and click the websites to see what appears as the referrer.

11

I have already tried these, but just to be sure I applied verbatim your config. The result is the same: the referer is gone (which is what I want for general browsing), but some streaming video I use does not work. I guess I’ll try to make my own extension at this point…

12

What you’re specifically asking for is to spoof the referrer, where you set the target url to be sent. This can only be done with extensions. There’s no other way. Try doing a search for spoof referrer or change referrer in mozilla addons. Here’s a few:

13

I’m also a bit surprised to learn exactly how this works, since it seems like an obvious privacy concern. I think this particular scenario is unlikely, since it would require clicking on a USPTO link from the other site :face_with_tongue:

14

This will be the case only if you land to uspto.gov from a link of pornhub.com which is unlikely.
If you type directly an url on a open tab or you open a new tab it will not send a referrer.

15

Not really. I just want the estension to enable or disable the referrer setting (the ones you already wrote in your comment). I think this is a feature that Mozilla should implement in-browser ideally, but I agree that right now extensions are the only option. And I had already searched and found the ones you linked, the problem is that these seem to come from obscure devs and have very low adoption, that is why I was asking for recommendations. Can anyone vouch for any of these? Otherwise I will write one myself for my personal use.

Hey, don’t question my sexual preferences! I have… special needs :joy:

16

What about setting ‘network.http.referer.referrerLengthLimit’ to 0 ?

Note: I think messing with the HTTP referer will break some site that rely on it for security

17
Value Privacy Impact Trade-off
0 (no limit) Worse — sends the full URL regardless of length No protection against long referrer leaks
4096 (default) Balanced — caps what’s sent while remaining compatible Good balance of privacy and functionality
Very low (e.g., 256) Marginal additional privacy gain High risk of site breakage

Bottom Line

Leave referrerLengthLimit at its default of 4096 — it’s already tuned for a good privacy/functionality balance. Focus your privacy hardening efforts on the trimming and cross-origin policies instead, which control what information is shared rather than just how many bytes.