Geek Answers Handbook

When does the browser specify "referrer" in the header of the HTTP request?

I have a login page, and users from different domains are redirected to this page for single sign-on purposes. I use the HTTP referrer header field to find out where the user came from, so when I log in successfully, I return it back to my own domain. But sometimes my referrer is not installed, and in other cases it is installed. Why?

+4
source share
2 answers

Users can go to your page using various methods:

  • By entering the URL of your page directly into the address bar of your browser
  • By clicking on the link to your site from another site
  • Overloading the current page
  • Submitting a form to your site (sending a POST request to your site)
  • Move the buttons back / forward of your browser.
  • Redirects from the previous page to the current page.

Now browsers really differ in how and when they set the referrer header field. But, as a rule, you can be sure that when you click a link or when submitting a form (post request) they set the referrer field. Also, if you went to the current page through a redirect or link, the browser still saves the referrer header to F5 (reloading the page).

If you see that your referrer field is empty, this is because someone knows your URL of the login page and enters it directly into the address bar, or someone bookmarks, therefore sends a GET request.

As a rule, you should not always expect the referrer field, because it is out of your control. You must use cookies or query strings because they are under your control.

+11
source

Another thing is that for some users, the abstracting option can be disabled in their browsers as part of the browser security settings.

+4
source

More articles:


All Articles