Documentation on how referrer header is set? 1

[thedaver]

I'm having trouble finding documentation that describes (even just for IE and FF) how the referrer header is set and more importantly why.

I'm trying to get at the following questions:
1) If the page is called through a form POST, does the referrer necessarily reflect that in any way (irrespective of the GET and POST values themselves having data or not)
2) If the page is called by typing the URL directly into the browser's URI window, can you differentiate that?
3) If the page is arrived at by a link click-through from the prior page, can you tell this apart from #2 or #1??

Sorry, this is a bit 1990s, but we're trying to settle this without going into a big R&D scripting exercise.

Help appreciated! D.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[BillyRayPreachersSon]

AFAIK, the HTTP referrer is not mandatory, and therefore you cannot always rely on it being present.

It might well be sent, but you cannot rely on it being so.

Hope this helps,
Dan



Coedit Limited - Delivering standards compliant, accessible web solutions

[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[feherke]

Hi

It might well be sent, but you cannot rely on it being so.

And even if is sent, may not arrive. Because overzealous security softwares may remove it on its way.

And even if an HTTP_REFERER arrives, it may be a fake one.

Feherke.

http://rootshell.be/~feherke/

 

[thedaver]

OK, so that's fair: it may not arrive, it may be forged, it is not mandatory. All agreed.

However, I'm still curious as to the rules that we think the browsers are using to generate the referrer. Still interested in speculation there.

Help appreciated! D.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[AdaHacker]

Why not just ask the source?

14.36 Referer

The Referer[sic] request-header field allows the client to specify, for the server's benefit, the address (URI) of the resource from which the Request-URI was obtained (the "referrer", although the header field is misspelled.) The Referer request-header allows a server to generate lists of back-links to resources for interest, logging, optimized caching, etc. It also allows obsolete or mistyped links to be traced for maintenance. The Referer field MUST NOT be sent if the Request-URI was obtained from a source that does not have its own URI, such as input from the user keyboard.
Referer = "Referer" ":" ( absoluteURI | relativeURI )

Example:
Referer:

http://www.w3.org/hypertext/DataSources/Overview.html

If the field value is a relative URI, it SHOULD be interpreted relative to the Request-URI. The URI MUST NOT include a fragment. See section 15.1.3 for security considerations.

So, to answer your questions:
1) No, there's nothing to indicate that a form post should be differently from any other URI request.
2) You don't send a referer for directly typed URIs.
3) Again, there's nothing to indicate that a link-click should be treated differently from a POST.

 

[thedaver]

AdaHacker, oustanding! Thanks all!

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/