I’m rather certain, the way it works is that it removes parameters that are named like well-known tracking parameters. For example, most webpages use Google Analytics, so you see UTM parameters everywhere.
A “reset your password” link could theoretically use a parameter that’s named utm_content, then it would presumably get removed by this feature, but I see no sane reason why one would name their password-reset parameter like that.
In general, such tracking parameters are usually named in a way that it will rarely clash with other parameters a webpage may want to use, so for example they may have a prefix like utm_.
Looking at some comments on the linked post, I think you are right, and it would probably be fine for things like a password reset. I could play around with it, but my laptop is in the other room.
I’m rather certain, the way it works is that it removes parameters that are named like well-known tracking parameters. For example, most webpages use Google Analytics, so you see UTM parameters everywhere.
A “reset your password” link could theoretically use a parameter that’s named
utm_content, then it would presumably get removed by this feature, but I see no sane reason why one would name their password-reset parameter like that.In general, such tracking parameters are usually named in a way that it will rarely clash with other parameters a webpage may want to use, so for example they may have a prefix like
utm_.Oh, so it’s not just stripping the GET parameters? Okay, that’s smarter than I was assuming
Stripping all GET parameters would break many, many legitimate webpages. 🫠
Looking at some comments on the linked post, I think you are right, and it would probably be fine for things like a password reset. I could play around with it, but my laptop is in the other room.