ETags can be used for tracking, but I happened to notice that Safari
handles them differently from Chrome (and Firefox). I believe it's non-standard
because it doesn't work across domains. If we imagine the browser using a map to
see if it should send If-None-Match
, Firefox and Chrome are keyed only on the
URL to the asset.
(http://example.com/image.gif): <etag>
However, Safari is keyed on the host as well as the asset.
(http://mysite.com, http://example.com/image.gif): <etag>
This seems like an pretty effective way of preventing tracking with ETags. Anyone know how I can get Chrome to do the same thing? Or is it just a bug in Safari??
Update
I put the same image on two different sites (loaded from duckduckgo images; file name shows up as iu
). Sorry about the broken links. I don't have permission to post them.
- jsfiddle net/wmwfr4s8/
- jsbin com/nuhiqupeme/edit?html,output
The testing procedure I followed:
- Clear cache.
- Open two empty tabs and open the debugger in each tab.
- Load the first URL: If-None-Match not sent.
- Reload the first URL: If-None-Match sent.
- Load the second URL: If-None-Match not sent.
- Reload the second URL: If-None-Match sent.