Redirects & Mediawiki.

March 18, 2008 5:25 PM

I have a private wiki, & I'd like to keep it from showing up in server logs. Specifically, I'd like to strip out the referrer information by having external links go through a redirect. How do I have Mediawiki munge external links to include the redirector? Also, would using a redirect really do what I want, or does this really vary by browser?
posted by Pronoiac to Computers & Internet (15 answers total)

Response by poster: I know about redirecting via Google - http://www.google.com/url?sa=D&q=URL - & robots.txt is preventing the wiki from being spidered.

Is redirector the right word here? This seems to be the preferred name for tools that rewrite Squid proxy requests.
posted by Pronoiac at 5:26 PM on March 18, 2008

Best answer: The easiest way, yes, is to do a server-side redirect of some sort. I tried writing a JavaScript link and it still sent a referrer.

Of course, you could also block your browser from sending the referrer. In Firefox this is: enter a URL of about:config, look for network.http.sendRefererHeader (sic) in the list, double-click it and change its value to 0.
posted by kindall at 5:44 PM on March 18, 2008

Since MW is running on top of Apache, you can add a rewrite rule that will change the URLs that appear on a page. MW will construct the page, pass it to Apache where you can do your rewriting, then the page loads into the browser. I'm not sure if RewriteRule will work for outbound traffic, but in the past I've used mod_ext_filter to do something very similar to what you're talking about. Just write a sed line or perl or bash script or whatever, throw it in mod_ext_filter and presto, changed URLs. This does not speak to whether you could do this entirely within MW or via MySQL or anything like that, but it's possible that you could go that way as well.
posted by rhizome at 5:49 PM on March 18, 2008

I'm sure you'll find a way to accomplish more or less what you want, but the real answer is probably no, you can't do it. In the end, if it's publicly available, someone will figure out where it is.

What about approaching it backwards - have your site reject referred pages, and only accept direct links, so even if someone does come across it, they won't see much.
posted by TravellingDen at 8:35 PM on March 18, 2008

Response by poster: It's already locked down, so you need an account to see anything, & account creation is disabled.

I could reconfigure my browser, or use Privoxy, I'm just looking for something more elegant, I suppose. It seems a Mediawiki extension might be called for.

This is a bit of a thought exercise, admittedly, one part of a complete morning breakfast security setup etc.
posted by Pronoiac at 9:47 PM on March 18, 2008

Response by poster: Looking back at Kindall's comment, I like it more. Some sites break without a referrer, I've heard. RefControl looks like a selective version of that.
posted by Pronoiac at 10:31 PM on March 18, 2008

RefControl only keys on sites that you go for -- it doesn't seem to be able to block only specific sites from being referrers. I looked at it but didn't recommend it for that reason. (Of course, you could block the referrer for all sites, then enable it for any sites where that causes a problem, but that's kind of a pain.)
posted by kindall at 10:38 PM on March 18, 2008

I'm a bit confused. Whose server logs are you trying to stay out of? If you're trying to avoid having HTTP requests logged by corporate proxies, I don't think that's going to happen as long as at the end of the process, the URL for your site is in the user's location bar.
posted by me & my monkey at 1:09 AM on March 19, 2008

Response by poster: kindall: Yes, RefControl goes much further than necessary, into overkill. Modifying it to only block referrers from a certain site would be a bit closer to what I had in mind.

m&mm: Do you know what referrer logs are? I've got a personal wiki that has some external links. I'd like to be able to use it & follow those links without leaving traces (meaning, the full address of the wiki page) at the linked sites. ... Though that's not the question I asked, I think this might be avoidable with SSL, if secure connections aren't also proxied.
posted by Pronoiac at 4:01 PM on March 19, 2008

Best answer: HTTPS on the originating side kills referrer dead (said grumblingly as a developer who's reliance on HTTP_REFERER has had him bitten a number of times). This is per IETF spec and followed by IE and Firefox as a start...
posted by Ogre Lawless at 5:16 PM on March 19, 2008 [1 favorite]

Response by poster: Wow, that's news to me. So putting the wiki on a secure site would incidentally do what I'm looking for.
posted by Pronoiac at 9:25 PM on March 19, 2008

Yeah, news to me too! I'll throw that in my mental toolbox.
posted by kindall at 3:22 PM on March 20, 2008

Best answer: The Adaptive Referer Remover firefox extension does exactly that.
posted by Sharcho at 4:59 AM on April 1, 2008

Response by poster: I guess for now I can limit myself to Firefox only, until/if I work out a secure server, which lets me save that question for later. Thanks everybody!
posted by Pronoiac at 6:01 PM on April 1, 2008

I discovered you can also have the Squid proxy server strip out the referrer headers. (You can strip out any header you want, in fact.)
posted by kindall at 3:41 PM on April 2, 2008