Manipulating the Referer

**BozoClown** · #1 (**permalink**) 07-14-2008, 12:58 AM

I have this testing setup with the following sites
SiteA
SiteB
SiteC

SiteA has a link to SiteB. SiteB redirects(in some way) to SiteC.

On SiteC this php code

Code:

echo $_SERVER['HTTP_REFERER'];

shows SiteB as the referer, also firefox 'view page info' on SiteC shows SiteB as the referer.

I know this has been a contentious issue and at this point of my testing I only need to know whether this means the server really records SiteB as the referer.

I don't know whether this would have any effects on the results, but sites A,B and C in my testing are on the same domain. So I am hoping(not sure) if SiteA and SiteC are on different domains and servers then the SiteC server should not have a clue about SiteA.

PS: This is not about cookie stuffing, although I am also wondering whether the method would deal with the referer issue while cookie stuffing. At this point it is for cloaking purposes only, where I would like the merchant to see the referer as a site on my domain not yahoo, youtube, metacafe, myspace or whatever for that matter.

**Genjutsu** · #2 (**permalink**) 07-14-2008, 01:05 AM

depends on your method of redirection.

**BozoClown** · #3 (**permalink**) 07-14-2008, 01:24 AM

Quote:

Originally Posted by Genjutsu

depends on your method of redirection.

You mean, the redirection method can lead to different referer being shown on the client side to that on the server side?

**Genjutsu** · #4 (**permalink**) 07-14-2008, 02:00 AM

Quote:

Originally Posted by BozoClown

You mean, the redirection method can lead to different referer being shown on the client side to that on the server side?

yes, the redirection method determines what referer is shown.

For example, using a php header redirect would show site A as bieng the referer.

Code:

<?PHP

header('Location: http://www.example.com/');

?>

**BozoClown** · #5 (**permalink**) 07-14-2008, 02:18 AM

Quote:

Originally Posted by Genjutsu

yes, the redirection method determines what referer is shown.

For example, using a php header redirect would show site A as bieng the referer.

Code:

<?PHP

header('Location: http://www.example.com/');

?>

I know the method decides the referer, my query is, can the method result into two different referers for the client side and server side.

My current method shows(on the client side) SiteB as the referer, I want to make sure what I see on the client side mirrors what is recorded on the server side.

I am using

Code:

echo $_SERVER['HTTP_REFERER'];

(which is server side) to show me (client side) who the referer is. I don't want to make a mistake of believing I have set up the right referer yet there is another variable storing a different referer?

**Genjutsu** · #6 (**permalink**) 07-14-2008, 04:58 AM

Again, this depends not only on the method you are using, but also the browser that the user is using. The only way to be certain is to redirect, test and redirect again using the same method you used the first time if the referer passes the test.

Confusing I know, but it takes a little bit of logic to make sure everything is set up properly.