RFC doesn’t specify any referrer-specific behavior in status 301 definition, nor 301-specific behavior in Referer header definition. Thus, I have to say that although this referrer-preserving behavior is logical, it is not defined in RFC and thus you can never be sure.
Yes. Just use document.referrer.
You can’t. It is impossible. The specification requires that the browser abort the setRequestHeader method if you try to set the Referer header (it used to be that User-Agent was also forbidden but that has changed).. If you need to set Referer manually then you’ll need to make the request from your server and not … Read more
request.referrer contains the URL the request came from, although it might not be sent by the client for various reasons. The attribute takes its value from the Referer (not a typo!) header: referrer = request.headers.get(“Referer”) or, using the Flask shortcut: referrer = request.referrer See this tutorial for an example.
As a general rule, you should not trust the HTTP Referer Header for any matter of importance, except for purely informative statistical analysis of who your visitors are or when looking for patterns of behaviour among the users of your own site. Under no circumstance it is advisable that you use this header for AAA … Read more
Using HTTP_REFERER isn’t reliable, its value is dependent on the HTTP Referer header sent by the browser or client application to the server and therefore can’t be trusted because it can be manipulated. Regarding the Referer header, section 15.1.2 of RFC2616 states: Therefore, applications SHOULD supply as much control over this information as possible to … Read more
You can get it by… req.headers.referer in… var http = require(‘http’); server = http.createServer(function(req, res){ … }
I don’t know about the 302, but I tested the 301 on some browsers today, here the results: SCENARIO: user clicks link on domainX that points to domainA. domainA does a 301 redirect to domainB. IE8 referer when landing on domainB is: domainX (even when using InPrivate browsing and even when user opens link in … Read more
The REFERER is sent by the client’s browser as part of the HTTP protocol, and is therefore unreliable indeed. It might not be there, it might be forged, you just can’t trust it if it’s for security reasons. If you want to verify if a request is coming from your site, well you can’t, but … Read more