Comment 1 for bug 548906

Revision history for this message
Zooko Wilcox-O'Hearn (zooko) wrote :

Okay I've reproduced this and I can tell that it happens when I have network.http.sendRefererHeader = 0 or = 1 but it does not happen when I have = 2. I set that configuration (for privacy and security reasons) by following these instructions: http://cafe.elharo.com/privacy/privacy-tip-3-block-referer-headers-in-firefox/

Suggestions:

1. Make the error message more clear in the case that this occurs. For example, the error message could say "I'm sorry, but launchpad requires Referer headers to perform this action and there is no Referer header present. Perhaps you have blocked Referer headers or perhaps you navigated to this URL in an unexpected way. Please unblock Referer headers for launchpad.net and try again, or contact $SUPPORT_CHANNEL for assistance."

2. Change launchpad to perform correctly without Referer headers. They are sometimes blocked by client-side privacy and security tools and relying on them is risky since launchpad coders may inadvertently come to rely on them for security when of course they can be easily forged by an attacker.