Referer (misspelled in the spec) has been a part of HTTP from day 1.
Feels crazy this isn’t disabled by default
alt Hacker News
Feels crazy this isn’t disabled by default