Consider adding a default rule for <SUBDOMAINS>

[anewuser]

Referer Modifier has a <SAME> rule that allows users to keep first-party referers, but it strictly adheres to full local hostnames, removing referers from requests between example.org and download1.example.org.

Other extensions, such as Smart Referer and Privacy Possum, consider subdomains as belonging to the same website by default, and even strongly recommend users to keep the settings that away to avoid breaking sites unexpectedly.

Since you've chosen to code <SAME> in its current form, please consider adding a new default rule for <SUBDOMAINS>, which maybe can stay grayed-out unless <SAME> is set to Keep.

[airtower-luna]

I'm not sure that's a good idea. Tracking tools hiding behind subdomains is a well-known problem, that's why uBlock Origin has CNAME uncloaking. I think implementing #15 and then adding rules for specific 2nd level domains where you really need this would be a better solution.

[anewuser]

I knew about that uBlock Origin option but didn't think of it while using your extension, so now I understand your reasoning for not wanting users to Keep full referers for all subdomains indiscriminately.

However, I've found out that all sites that I've encountered so far that were broken because of this could actually be fixed by just spoofing all referers to their respective pruned base domains. For instance:

example.com → Replace →  https://example.com/
example.org → Replace →  https://example.org/

What about adding an option for this to be the default behavior for subdomains? This would make the extension avoid breaking many sites without potentially compromising the privacy of users who enabled it. If you make requests to cloaked.example.com, it already knows you're browsing example.com anyway.

[airtower-luna]

#68 will let you define rules that apply within domains including their subdomains by setting target and origin to the same (e.g.) second level domain. Tests and comments welcome! 😺

[anewuser]

I think that my last comment was too confusing.

You didn't like the idea of adding the option to Keep referrers between all subdomains because you were concerned about cases like https://blog.example.com/2022/08/specific-article → https://cloaked.example.com/tracker.

So, I pointed out that having Keep as an option isn't necessary. Replacing cross-subdomain referrers with the base domain would be enough. The situation above would look like https://example.com/ (modified referrer) → https://cloaked.example.com/tracker. This unbreaks sites automatically while presenting no privacy risk whatsoever.

In other words, my request is to add this option:

That way, users won't need to manually add domain-specific rules like these to unbreak sites:

[airtower-luna]

My main point is that with origin matching you can actually restrict whatever action to requests within a second level domain, instead of all requests to the domain.

Of course that's way less of a concern if "replace" is sufficient, I have three domains where "keep" within the second level domain is necessary to make certain things work. And with a default "prune" (I would not want to add a special action) for "same second level domain" I'd still have to have those rules.

Is it much more different for you? From my own usage I would consider additional options not worth the effort, but either way I'll unlink the PR.

[anewuser]

My main point is that with origin matching you can actually restrict whatever action to requests within a second level domain, instead of all requests to the domain.

I got it, but all of my specific rules have either Replace or Target. My actual referrers are never leaked outside the same exact hostname, so I don't really need to specify the Origin in any rule.

Is it much more different for you? From my own usage I would consider additional options not worth the effort, but either way I'll unlink the PR.

I'm comfortable with the extension too, but it can be too troublesome for new users. With my proposal, people wouldn't need to troubleshoot as many broken sites, especially if they set <Any domain> to Remove, like me.

If I had created this extension, I'd go as far as creating a default whitelist, which could be based on the referrer entries in the AdGuard Stealth Mode whitelist. It could, at least, unbreak things like Google Drive videos by default (target: youtube.googleapis.com; replace with: https://drive.google.com/). This would make the extension more attractive to the average user.

This is your project, though, so it's okay if your final decision is to keep everything the way it is.

[Zap0]

I was about to create a new issue since I just assumed that the same domain rule was also including subdomains like other rules and was wondering why my request to drivers.amd.com from amd.com was having its referer stripped despite same domain being set to keep.

Now I spent 20 minutes of my life on this and have a rather silly looking amd.com to amd.com keep rule in the config.

Just letting you know that this is still an issue people face. Maybe explicitly state that the same domain default rule does not match subdomains or consider a default list to unbreak common sites like suggested above.