This article is about website owners. The best thing you can do as a user is enabling the 'Referer' for same-origin requests only. That way, you keep almost all the advantages of the 'Referer' but at the same time fix almost all the privacy issues.<p>In Firefox, you can do this by setting `network.http.referer.XOriginPolicy` to `1` in `about:config`. Or use a `user.js` file with other helpful privacy settings, e.g. <a href="https://github.com/delight-im/Secure-Firefox" rel="nofollow">https://github.com/delight-im/Secure-Firefox</a>
The URL refresh thing can be done without JavaScript by having a little server side entrypoint that redirects to a destination URL with the same header.<p>I believe it should be widely supported.
By controlling the referer header you can do all sorts of cool things like tamper with authenticated Google search histories in a way which makes it look like the person actually searched for a particular term:<p><a href="http://thefutureisastephenkingnovel.com/badforensics/" rel="nofollow">http://thefutureisastephenkingnovel.com/badforensics/</a>
Before loading the page I thought this might be about hiding the client's ip (that connected to an SMTP server) in the mail headers. Is that possible at all?