Client does not take Referer headers when HTTP is requested under HTTPS

zhanhailiang 日期：2015-01-08

Today, test found in
https://mlogin.vip.com/user-login.html?back_act=http%3a% 2F%2FM.VIP.COM%2FUSER.HTML
http://mstats.vip.com/v1/timing/m?_t=1420647129290 &p2=240&p4=377&t0=0&t1=63&t2=474&t3=642&t4=1&t6=411&t7=919&t8=3&t9 =1059
always reported 412:

GET http://mstats.vip.com/v1/timing/m?_t=1420647129290&p2=240&p4=377&t0=0&t1=63&t2=474&t3=642&t4=1&t6=411&t7=919&t8=3&t9=1059 412 (Precondition Failed)

Look at the code of the Monitoring platform, return status code 412 is because the monitoring platform needs to referer the head to determine the platform, but the request is not Referer head:

get/v1/timing/m?_t=1420647129290&p2=240&p4=377&t0=0&t1=63&t2=474 &t3=642&t4=1&t6=411&t7=919&t8=3&t9=1059 http/1.1host:mstats.vip.comconnection: keep-alivepragma:no-cachecache-control:no-cacheaccept:image/webp,*/*;q=0.8user-agent:mozilla/5.0 (Windows NT 6.1; WOW64) applewebkit/537.36 (khtml, like Gecko) chrome/39.0.2171.95 safari/537.36dnt:1accept-encoding:gzip, deflate, sdchaccept-language:en-us,en;q=0.8cookie:m_vip_province=104104; WAP[P_WH]=VIP_NH; WAREHOUSE=VIP_NH; Wap_a1_sign=1; WAP_CONSUMER=A1; mars_pid=105; mars_cid=1420628456366_8d67e997a179843a61b1d3151d6bb9db; mars_sid=a4148eed668a36b75d29c288580f7099; visit_id=628ed24779611f6233fa107a22b83450 

Indeed the request header does not have a referer head, originally because the HTTP protocol stipulates:

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.

Reference article:

1. Original HTTPS and Referer head loss issues

Client does not take Referer headers when HTTP is requested under HTTPS