No-referrer redirects

30 January 2013

Browsers pass a referrer. Sometimes that’s not always what you want. Unfortunately browsers don’t really provide a way to stop a referrer on an outbound link. There is talk of a rel=”noreferrer” attribute for a tags, but it’s not really supported yet.

Fortunately there’s a hack around it - meta refresh tags don’t pass a referrer (in every browser I’ve tested - let me know if you run into any exceptions). And you can dynamically create a meta refresh tag in it by using a data url.

Of course, you really should just use SSL and skip all this bullshit…

Add the following helper to your app/helpers/application_helper.rb

  def no_ref_link_to text, url
    url = Rack::Utils.escape_html url

    meta = <<-HTML.split.join ' '
      <!DOCTYPE html>
      <html>
        <head>
          <meta http-equiv="refresh" content="0;URL='#{url}'" />
        </head>
      </html>
    HTML

    meta = Rack::Utils.escape(meta).gsub '+', '%20'
    <<-HTML
      <a href="data:text/html;charset=utf-8,#{meta}">
        #{text}
      </a>
    HTML
  end