0

I have a PHP file which contains some important data of my website. I have set up the below written HTTP REFERER script in that file. For now its only accessible when redirected from a specific page of my website backend (which is password protected). Is it safe to assume that this file cannot be accessed by any other means? 

<?php
    if ($_SERVER['HTTP_REFERER'] == "http://yoursite.com/IMPORTANT_FILE.php") {
        // continue
    } else {
        header("Location: http://yoursite.com/");
        exit(); //Stop running the script
        // go to form page again.
    }
?>
Fluffeh
  • 33,228
  • 16
  • 67
  • 80
saibbyweb
  • 2,864
  • 2
  • 27
  • 48

1 Answers1

6

No. $_SERVER['HTTP_REFERER'] can be spoofed so it cannot be relied upon for safety or accuracy. This chrome extension makes it trivial for a newbie to do.

A better way to do this is authenticate your users before they attempt to access your protected files. Only after passing this authentication can they access them. See this answer for an example.

Community
  • 1
  • 1
John Conde
  • 217,595
  • 99
  • 455
  • 496