Determining Referer in PHP

php http-referer
UnkwnTech picture UnkwnTech · Oct 3, 2008 · Viewed 150k times · Source

What is the most reliable and secure way to determine what page either sent, or called (via AJAX), the current page. I don't want to use the $_SERVER['HTTP_REFERER'], because of the (lack of) reliability, and I need the page being called to only come from requests originating on my site.

Edit: I am looking to verify that a script that preforms a series of actions is being called from a page on my website.

Answer

Seldaek picture Seldaek · Oct 3, 2008

The REFERER is sent by the client's browser as part of the HTTP protocol, and is therefore unreliable indeed. It might not be there, it might be forged, you just can't trust it if it's for security reasons.

If you want to verify if a request is coming from your site, well you can't, but you can verify the user has been to your site and/or is authenticated. Cookies are sent in AJAX requests so you can rely on that.

Related questions

Get original URL referer with PHP?

I am using $_SERVER['HTTP_REFERER']; to get the referer Url. It works as expected until the user clicks another page and the referer changes to the last page. How do I store the original referring Url?

Read More
Redirect to referer url in codeigniter

In messaging system of my project when you get a message from a user you a email alert saying that the another user has sent a message to view the message click here (i.e the url of message) So …

Read More
Notice: Undefined index: HTTP_REFERER

Notice: Undefined index: HTTP_REFERER $http_referer = $_SERVER['HTTP_REFERER'] i used this from tutorial.and it looks okay also code is calling it from including file what should i change? i added print_r($_SERVER); and now page gives …

Read More