You can dynamically load JavaScript (from any URL) from Javascript and Firefox won't send along the HTTP Referer (sic) header.
Test with, say:
function js_include (uri) {
var se = document.createElement("script");
se.src = uri;
document.body.appendChild(se);
}
....
js_include("http://victim.example.com/");Dear Lazyweb, tell me what other browsers do/send. I'd go upstairs and use IE on Dina's laptop but I'm too lazy to install ethereal on it. Plus I should go back to bed.
Update: Couldn't sleep. Results:
Firefox/1.0.2 (Debian package 1.0.2-2): No Referer
Firefox/1.0.1 (Windows): Referer
IE 6: Referer
So is this a regression from 1.0.1 to 1.0.2, or is it a Linux/Windows thing?
Update#2:
Firefox/1.0.1 (Linux, not Debian): No Referer
Looking like a Linux thing.