0

I am trying to setup a custom referrer value while redirecting. I am trying this with both Javascript and PHP but none of them are working.

JS code : window.document.__defineGetter__

<script>
var reff = ["https://www.stackoverflow.com", "https://www.stackexchange.com"];
var randomreff = reff[Math.floor(Math.random()*reff.length)];
delete window.document.referrer;
        window.document.__defineGetter__('referrer', function () {
            return randomreff;
        });
</script>
<script>
window.onload = function() {
  window.location.href = "https://www.example.com";
};
</script>

JS Code : Object.defineProperty

const reff = ["https://www.stackoverflow.com", "https://www.stackexchange.com"];
const randomreff = reff[Math.floor(Math.random()*reff.length)];
Object.defineProperty(document, "referrer", {get : function(){ return randomreff; }});
window.onload = function() {
  window.location.replace("https://www.example.com");
};

PHP code :

//header("Referrer-Policy: no-referrer");
header("Referer: http://www.stackoverflow.com");
header("Location: https://example.com", true, 301);

Note : I have already checked the article How to manually set REFERER header in Javascript? and this is not a duplicate. Above article to set referrer on current window and i want to set custom referrer on redirected window/website.

Mehul Kumar
  • 461
  • 8
  • _"and i want to set custom referrer on redirected window/website"_ - and what makes you think that _should_ be possible ...? – CBroe Apr 14 '23 at 12:41
  • 1
    `header("Referer: http://www.stackoverflow.com");` - absolutely utterly pointless, of course - `Referer` is a _request_ header, `header()` in PHP sets _response_ headers. – CBroe Apr 14 '23 at 12:42
  • @CBroe I have mixed review upon searching on Google. So, thought it might be possible as referrer value is not `read-only` because i am able to change on `my current page`. I hope there can be any way where i can send a custom referrer value. – Mehul Kumar Apr 14 '23 at 12:43
  • `i am able to change on my current page`...maybe, but the browser will not allow it to be transmitted to another site. You can do what you want with your own page. This question is already answered. – ADyson Apr 14 '23 at 12:43
  • `I have mixed review`...such as? Please provide links to sources which tell you that setting a custom referer is possible (and preferably actually demonstrate it). – ADyson Apr 14 '23 at 12:44
  • @ADyson I got it. I thought because i am the open redirecting it to external domain maybe i can able to send some value. Like "No-referrer" rules works but custom referrer don't. – Mehul Kumar Apr 14 '23 at 12:44
  • 1
    No, you can't do it because it's effectively providing dishonest information to the receiving site. You can maybe imagine how that could be horribly mis-used. REFERER can already by spoofed by non-browser HTTP clients (as can any request header or value, of course), but there is a safeguard built into standards-compliant browsers so it can't be exploited by dodgy websites etc. on behalf of end users. – ADyson Apr 14 '23 at 12:46
  • 1
    JavaScript can intercept and manipulate background requests for the current site (https://stackoverflow.com/q/43813770/1427878), but I don't think the same thing is possible for "linking" to an external page. – CBroe Apr 14 '23 at 12:48
  • @ADyson i understood totally. Custom referrer is not possible but how it can be harmful. Referrer are just value and it cannot harm external website or visitors. – Mehul Kumar Apr 14 '23 at 12:48
  • It can if they rely on it for referral / usage statistics, advertising / afilliate revenue etc. – ADyson Apr 14 '23 at 12:49

0 Answers0