Controlling Cross-Origin Referers in Firefox

This article provides a complete breakdown of the network.http.referer.XOriginTrimmingPolicy setting in the Mozilla Firefox web browser. You will learn what the HTTP Referer header does, how this specific preference enhances user privacy by stripping sensitive data from URLs during cross-origin requests, the exact meaning of its three configuration values, and how to modify the setting yourself.

Understanding the Cross-Origin Referer Header

When you click a link to travel from one website to another, your browser usually sends an HTTP Referer header to the destination website. This header contains the URL of the webpage you just left. When moving between two entirely different domains—known as a cross-origin request—sending the full URL can be a privacy risk. Full URLs often contain sensitive data in their paths or query strings, such as search terms, session IDs, or personal identifiers.

How network.http.referer.XOriginTrimmingPolicy Works

Firefox allows users to control how much information is shared in the Referer header during these cross-origin requests through the network.http.referer.XOriginTrimmingPolicy preference. Instead of blocking the Referer header entirely (which can break some websites), this setting acts as a filter that trims the URL down to less sensitive components before sending it to the external server.

To understand how this setting alters your data, imagine you are on the following URL and click a link to an external website: https://www.example.com:8080/account/profile.html?user=john_doe

The network.http.referer.XOriginTrimmingPolicy setting accepts three integer values (0, 1, or 2), which dictate how that URL is modified before being sent as the Referer.

Value 0: Send the Full URL

When set to 0, Firefox does not trim the cross-origin Referer header at all. It sends the scheme, host, port, path, and query string.

  • Data sent: https://www.example.com:8080/account/profile.html?user=john_doe
  • Privacy impact: Low privacy. The destination site sees the exact page you were on and the specific parameters you were using.

Value 1: Send the URL Without the Query String

When set to 1, Firefox strips away the question mark and any query string parameters, but keeps the path to the specific page.

  • Data sent: https://www.example.com:8080/account/profile.html
  • Privacy impact: Moderate privacy. Specific variables (like user=john_doe) are hidden, but the destination site still knows you were viewing the profile.html page.

Value 2: Send Only the Origin

When set to 2, Firefox trims the URL down to its bare minimum: the scheme, the host, and the port. All path and query information is removed.

  • Data sent: https://www.example.com:8080/
  • Privacy impact: High privacy. The destination website only knows that you came from example.com, protecting your specific browsing activity on that domain. This is the default setting in modern versions of Firefox for cross-origin requests.

How to Modify the Setting in Firefox

You can view or change this behavior directly within Firefox's advanced configuration page:

  1. Open Firefox and type about:config into the address bar, then press Enter.
  2. Click the Accept the Risk and Continue button if prompted.
  3. Copy and paste network.http.referer.XOriginTrimmingPolicy into the search bar at the top of the page.
  4. Click the Edit icon (shaped like a pencil) on the far right of the preference row.
  5. Type 0, 1, or 2 depending on your preference.
  6. Click the Save icon (shaped like a checkmark) to apply the change immediately.

Note that this setting only applies if Firefox is configured to allow cross-origin referers in the first place. If the separate network.http.referer.XOriginPolicy preference is set to block cross-origin referers entirely, the trimming policy will be bypassed because no header is sent at all.