Inspect the referrer in PHP

Is it possible to check who is entering your website in PHP. I have a web application ( written in PHP) that should only allow users entering from some particular websites. Is it possible to get the referral websites by examining the _Request object? If yes, how?

Here is Solutions:

We have many solutions to this problem, But we recommend you to use the first solution because it is tested & true solution that will 100% work for you.

Solution 1

Yes, but keep in mind some proxies and other things strip this information out, and it can be easily forged. So never rely on it. For example, don’t think your web app is secure from CSRF because you check the referrer to match your own server.

$referringSite = $_SERVER['HTTP_REFERER']; // is that spelt wrong in PHP ?

If you want to only allow requests from a specific domain you’ll need to parse some of the URL to get the top level domain. As I’ve learned more, this can be done with PHP’s parse_url().

As andyk points out in the comments, you will also have to allow for www.example.com and example.com.

Solution 2

While you can look at $_SERVER['HTTP_REFERER'] to get the referring site, don’t bet the farm on it. The browser sets this header and it’s easily spoofed.

If it’s critical that only people coming from specific referrers view your site, don’t use this method. You’ll have to find another way, like basic auth, to protect your content. I’m not saying that you shouldn’t use this technique, just keep in mind that it’s not fool-proof.

BTW, you can also block referrers at the apache level using mod_rewrite.

Solution 3

You cannot trust the referrer. Despite coming from the $_SERVER array, it is actually a user/browser supplied value and is easily faked, using such things as the Firefox RefControl addon.

Solution 4

You need to examine the $_SERVER array for the ‘HTTP_REFERER’ key.

Note: Use and implement solution 1 because this method fully tested our system.
Thank you 🙂

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

Leave a Reply