Does http-equiv="refresh" keep referrer info and metadata?

In testing here, Firefox and IE do not but Chrome does send the referrer (though this is inconsistent as well), regardless of whether it's going to the same domain or not.

Seeing as I can't find any spec stating what should be the standard behavior, and W3C in general discourages a META redirect, I'm not sure you can ever depend on this being consistent.

I did some additional testing with this. I had three URIs involved (all on the same domain):

• /page.html which had a link to the meta refresh
• /refresh.html which used a meta refresh to the destination
• /destination.html which used JavaScript to write the referrer into the page.

I ran the test in several browsers by opening page.html and clicking on the link, then observing what the referrer was on the destination. Here are the results:

• Internet Explorer - No referrer
• Firefox - No referrer
• Chrome - Referrer: http://example.com/refresh.html
• Safari - Referrer: http://example.com/refresh.html
• Opera - Referrer: http://example.com/refresh.html

None of the browsers showed http://example.com/page.html as the referrer the way that they would with a 301 or 302 redirect. So meta refresh can be used to some extent to obscure the referrer:

• Hide the specific page that had the link
• Remove the query string from the referrer
• If a third party site hosted the refresh, hide the specific site that linked
• Remove the external referrer on incoming traffic (useful in situations like this)

Indeed, it's possible to trick Firefox and Internet Explorer, getting the same redirection result, with preserved referrer, by simply using a form with delayed submit.

Example:

<form action="URL" method="GET" name="redirected"></form>
<script>
   setTimeout(function() {
      document.forms.redirected.submit();
   }, 1000);
</script>