How do you spoof HTTP_REFERER?

http-referer spoofing
rams picture rams · Mar 5, 2009 · Viewed 12.6k times · Source

I need to try and spoof the HTTP_REFERER passed my another page so that in the destination page, I can determine of the request is coming in from the "right" page and perform appropriate logic.

  1. How do I do that in JavaScript (AJAX)?
  2. Can I do that in ASP.Net?

TIA rams

Answer

Troy J. Farrell picture Troy J. Farrell · Mar 5, 2009

Generally speaking, you cannot cause other browsers to return a false HTTP_REFERER without an exploit, plug-in, or other extension. If you want to modify the value sent from your web browser and you are using FireFox, look at the Modify Headers extension.

In any case, you should never rely on HTTP_REFERER being accurate. There is no guarantee that the HTTP_REFERER you receive is not faked or simply not sent.

Related questions

Using cURL to download a site's HTML source, but getting different file than intended

I'm trying to use cURL and PHP to download the HTML source (as it appears in the browser) of here. But instead of the actual source code, this is returned instead (a meta refresh link set to 0). <html> &…

Read More
Get original URL referer with PHP?

I am using $_SERVER['HTTP_REFERER']; to get the referer Url. It works as expected until the user clicks another page and the referer changes to the last page. How do I store the original referring Url?

Read More
Getting the HTTP Referrer in ASP.NET

I'm looking for a quick, easy and reliable way of getting the browser's HTTP Referrer in ASP.Net (C#). I know the HTTP Referrer itself is unreliable, but I do want a reliable way of getting the referrer if it …

Read More