Query String Filter

The Brave query string filter aims at preventing the tracking of individual users without interfering with coarse-grained campaign-level tracking. We target parameters which are known to be specific to:

• a user,
• an email address, or
• an individual click.

This kind of tracking is typically used to leak a user's identity across site boundaries, such as via cookie matching (matching a first-party cookie to a link click).

In addition, we may remove parameters that can be used to circumvent our referrer capping protections. For example: parameters that would leak more than just the referring page's origin.

Implementation

We remove from the query string any parameters (i.e. the parameter name and value) before we proceed with a non-same-site GET request (navigations, subresources and redirects). This means that such parameters never make it to the server, omnibox or the Referer header, and cannot be recovered by scripts running on a page.

A notable exception to this intervention is the unsubscribe link in emails. If a user-identifying tracking parameter is required for that functionality to work, we make an exception. For example, the mkt_tok parameter is removed except when the string unsubscribe is present in the URL.

All issues related to this feature are tagged with the privacy/query-filter label.

List

The current list of parameters we filter can be seen in the query_filter component.

There are three types of rules:

• simple: the parameter name is removed from any URL (case-sensitive)
• conditional: the parameter name is removed only if the given regular expression does not match the URL
• scoped: the parameter name is only removed if the URL's base domain matches one of the given domains

QA

There is a test page at https://fmarier.github.io/brave-testing/query-filter.html.