> why would you not want this on non-private sessions
Information leaks. You click a link from your email to a news article. The URL for the news article has your email in it. Then you click an ad on the news article. The ad just got your email address.
Worse still - instead of an email address, it's a token that auto signs you in to your account with the news site.
Sites are pretty bad at sanitizing their outgoing referers.
Information leaks. You click a link from your email to a news article. The URL for the news article has your email in it. Then you click an ad on the news article. The ad just got your email address.
Worse still - instead of an email address, it's a token that auto signs you in to your account with the news site.
Sites are pretty bad at sanitizing their outgoing referers.