Allow referer when resource is on a subdomain of the parent page

Auditors: @bbondy
brave · Jul 22, 2016 · 144f786 · bbondy · Jul 22, 2016 · diracdeltas
1 parent 758e5d2
commit 144f786
Showing 1 changed file with 3 additions and 7 deletions.
diff --git a/app/filtering.js b/app/filtering.js
@@ -38,7 +38,7 @@ let initializedPartitions = {}
 const transparent1pxGif = 'data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7'
 
 // Third party domains that require a valid referer to work
-const refererExceptions = ['use.typekit.net', 'webtoon.phinf.naver.net', 'player.vimeo.com', 'cloud.typography.com', 'imgcomic.naver.net', 'fiddle.jshell.net', 'www.cibconline.cibc.com', 's.codepen.io']
+const refererExceptions = ['use.typekit.net', 'webtoon.phinf.naver.net', 'player.vimeo.com', 'cloud.typography.com', 'imgcomic.naver.net', 'fiddle.jshell.net', 'www.cibconline.cibc.com']
 
 /**
  * Maps downloadId to an electron download-item
@@ -195,12 +195,8 @@ function registerForBeforeSendHeaders (session) {
  if (requestHeaders['Cookie']) {
  requestHeaders['Cookie'] = undefined
  }
- }
- if (requestHeaders['Referer'] && !refererExceptions.includes(parsedUrl.hostname)) {
- // Clear cross-origin referer always.
- let parsedRef = urlParse(requestHeaders['Referer'])
- if (parsedUrl.protocol !== parsedRef.protocol ||
- parsedUrl.host !== parsedRef.host) {
+ if (requestHeaders['Referer'] &&
+ !refererExceptions.includes(parsedUrl.hostname)) {
  requestHeaders['Referer'] = undefined
  }
  }