0

Problem:

While redirecting user from http://sample.com to http://example.com via header('Location: http://example.com') - $_SERVER['HTTP_REFERER']; is empty.

Even after setting referer via header('Referer: http://sample.com') and then redirecting via header('Location: http://example.com') - $_SERVER['HTTP_REFERER']; is still empty.

Expected outcome:

http://example.com receives $_SERVER['HTTP_REFERER'] with appropriate referrer on redirection via header('Location: http://example.com')

Use case

Other:

  • behavior is correct if user cliks a link on http://sample.com
  • behavior is correct if user is redirected via javascript `window.location="http://example.com"
  • $_GET is not an option as it can be very easily forged since http://example.com can't validate invitation
m1k3y3
  • 2,762
  • 8
  • 39
  • 68
  • HTTP_REFERRER seems to be informed by the browser. It might work in Chrome but not on Firefox and vice-versa, it's just not trustworthy, since it's not standartized. – Lucas Bustamante Feb 01 '18 at 12:47
  • any proposals how to achieve it with and ensure cross-browser compatibility? – m1k3y3 Feb 01 '18 at 12:50
  • Can I ask what you need that header for? As the answer below states, this header is not trust worthy and doesn't always exist. – M. Eriksson Feb 01 '18 at 12:54
  • 1
    Perhaps redirect with a $_GET? – Lucas Bustamante Feb 01 '18 at 12:55
  • The only information you can be sure to receive "on the other side" is whatever information you put into that `Location:` header. So, yes, add some identifying information into the URL itself. – deceze Feb 01 '18 at 12:58

1 Answers1

0

From PHP Doc Server Variables:

'HTTP_REFERER' The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

You might be better off setting the current url in a Cookie or Session and using that.

Kasia Gogolek
  • 3,374
  • 4
  • 33
  • 50
  • well, cookie is the right thing to do if you are able to centralize it. in cross-domain case where some of those domains may be out of your control it will be impossible – m1k3y3 Feb 01 '18 at 12:50