You've been invited into the Kudos (beta program) private group. Chat with others in the program, or give feedback to Atlassian.
View groupJoin the community to find out what other Atlassian users are discussing, debating and creating.
Hello there,
One of our customers has following requirement.
They have number of external links within Confluence page. This means when a user clicks an external link within Confluence page, a referrer is sent to that external site.
Their security department don't like this, and they would like to know how to hide referrer. They put a proxy server between Confluence and external gateway, but this does not work when a user connects from outside of their company network via VPN.
Please let us know if anyone has a good idea regarding this issue.
Regards,
Daisuke Niwa
First, I'm not sure you quite understand how the data is leaked...
The referrrer data is in the HTTP request sent by the end user's browser, so it's from the user's PC to the external site, not from Confluence to the external site. So putting a proxy between Confluence & the outside world won't do that. The proxy MAY work as the user's HTTP request is sent via the proxy, which in turn, strips out the REFERRER field.
if it doesn't work for users on a VPN, then it's probably because their HTTP traffic isn't going via the company's proxy. Instead it's going direct via their local connection. I suspect it's a misconfiguration on the local PC that the security team have missed. My guess would be that the user's browser ISN'T routing traffic via the proxy.
Best solution, fix the user's browser to hardwire it to the company proxy
If that isn't possible, I think, IIRC, you can switch the confluence to SSL and the referrer field isn't sent when linking to another NON-Secure site.
or if you can 100% guarantee that all your users on on HTML5 browsers (iei Chrome), then you could maybe write a jquery statement to inject the "ref=noreferrer" attribute but it's not a good solution.
Get security to route the end user's HTTP traffic via the company proxy when on the company VPN, and switch to SSL
👋 Hi there, a few of us at Atlassian would love to learn about how you use "space settings" functionality in Confluence. A facelift to the space settings is long overdue and we want to start with im...
Connect with like-minded Atlassian users at free events near you!
Find an eventConnect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.
Host an eventYou're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.