How reliable is HTTP_REFERER?

http-referer
willz picture willz · May 17, 2011 · Viewed 30.3k times · Source

I need to check and record the referrer of visitors to my web application. How reliable is using HTTP_REFERER? And are there other alternatives?

Answer

Kev picture Kev · May 17, 2011

Using HTTP_REFERER isn't reliable, its value is dependent on the HTTP Referer header sent by the browser or client application to the server and therefore can't be trusted because it can be manipulated.

Regarding the Referer header, section 15.1.2 of RFC2616 states:

Therefore, applications SHOULD supply as much control over this information as possible to the provider of that information.

and

We suggest, though do not require, that a convenient toggle interface be provided for the user to enable or disable the sending of From and Referer information.

Many online privacy tools mangle this value and many browsers such as FireFox have for a long time permitted users to prevent this header being sent. So in a nutshell, I wouldn't rely on it for any serious purpose. For example, securing forms so that drive-by spammers can't post values, because the Referer can be spoofed.

For further reading see:

Using referer field for authentication or authorization (WayBackMachine)

Related questions

Get original URL referer with PHP?

I am using $_SERVER['HTTP_REFERER']; to get the referer Url. It works as expected until the user clicks another page and the referer changes to the last page. How do I store the original referring Url?

Read More
Getting the HTTP Referrer in ASP.NET

I'm looking for a quick, easy and reliable way of getting the browser's HTTP Referrer in ASP.Net (C#). I know the HTTP Referrer itself is unreliable, but I do want a reliable way of getting the referrer if it …

Read More
Determining Referer in PHP

What is the most reliable and secure way to determine what page either sent, or called (via AJAX), the current page. I don't want to use the $_SERVER['HTTP_REFERER'], because of the (lack of) reliability, and I need the …

Read More