Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Next challenges

Recent achievements

  • Global
  • Personal


  • Give kudos
  • Received
  • Given


  • Global

Trophy case

Kudos (beta program)

Kudos logo

You've been invited into the Kudos (beta program) private group. Chat with others in the program, or give feedback to Atlassian.

View group

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

How to hide referrer

Hello there,

One of our customers has following requirement.

They have number of external links within Confluence page. This means when a user clicks an external link within Confluence page, a referrer is sent to that external site.

Their security department don't like this, and they would like to know how to hide referrer. They put a proxy server between Confluence and external gateway, but this does not work when a user connects from outside of their company network via VPN.

Please let us know if anyone has a good idea regarding this issue.


Daisuke Niwa

1 answer

1 accepted

0 votes
Answer accepted

First, I'm not sure you quite understand how the data is leaked...

The referrrer data is in the HTTP request sent by the end user's browser, so it's from the user's PC to the external site, not from Confluence to the external site. So putting a proxy between Confluence & the outside world won't do that. The proxy MAY work as the user's HTTP request is sent via the proxy, which in turn, strips out the REFERRER field.

if it doesn't work for users on a VPN, then it's probably because their HTTP traffic isn't going via the company's proxy. Instead it's going direct via their local connection. I suspect it's a misconfiguration on the local PC that the security team have missed. My guess would be that the user's browser ISN'T routing traffic via the proxy.

Best solution, fix the user's browser to hardwire it to the company proxy

If that isn't possible, I think, IIRC, you can switch the confluence to SSL and the referrer field isn't sent when linking to another NON-Secure site.

or if you can 100% guarantee that all your users on on HTML5 browsers (iei Chrome), then you could maybe write a jquery statement to inject the "ref=noreferrer" attribute but it's not a good solution.

Get security to route the end user's HTTP traffic via the company proxy when on the company VPN, and switch to SSL

Suggest an answer

Log in or Sign up to answer
Community showcase
Posted in Confluence Cloud

Please tell us how you use Confluence space settings

👋 Hi there, a few of us at Atlassian would love to learn about how you use "space settings" functionality in Confluence. A facelift to the space settings is long overdue and we want to start with im...

125 views 5 6
Join discussion

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you