<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Safari does not send Referer Header to iframe src in certain situations"
href="https://bugs.webkit.org/show_bug.cgi?id=155754">155754</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Safari does not send Referer Header to iframe src in certain situations
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>Safari 9
</td>
</tr>
<tr>
<th>Hardware</th>
<td>iOS
</td>
</tr>
<tr>
<th>OS</th>
<td>iOS 9.3
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>New Bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>adam@sproutvideo.com
</td>
</tr></table>
<p>
<div>
<pre>Overview:
Safari seems to no longer send a Referer header when loading a page through an iframe in some situations. I'm still trying to isolate the exact cause, but it seems to happen reliably when an external reference, such as a javascript file or css file, is loaded in the document head. Also, the Accept header seems to switch to */* instead of text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Steps to Reproduce:
1) I set up a test case here: <a href="https://sproutvideo-examples.s3.amazonaws.com/safari_headers_b.html">https://sproutvideo-examples.s3.amazonaws.com/safari_headers_b.html</a>. View this page in Safari on a device running iOS 9.3
2) Refresh the page if the HTTP_REFERER header is still displayed. It should disappear after a reload.
Actual Results:
HTTP_REFERER header is missing
HTTP_ACCEPT header is */*
Expected Results:
HTTP_REFERER header should be <a href="https://sproutvideo-examples.s3.amazonaws.com/safari_headers_b.html">https://sproutvideo-examples.s3.amazonaws.com/safari_headers_b.html</a>
HTTP_ACCEPT header should be text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Platform:
iOS 9.3
Other Platforms:
Works as expected on iOS 9.2 and below
Works as expected on Safari, Chrome, Opera, and Firefox on Mac OSX 10.11.3
Works as expected on Safari, Chrome, Firefox, Opera, Edge, and IE on Windows 10</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>