referer header

[scorpion]

I wasn't too clear about how the referer header works if sent on a php page on domain Z. Does it mean that it will send to the destination server a referer specified in the header, even if it is not the actual referer of the site?

e.g.

header("Referer: [wanttosendthis.com");...]
header("Location: [anothersite.com");...]

With anothersite.com show in it's logs the referer as wanttosendthis.com?

[jatar_k]

I think you'd have to test it scorpion.

[georgiecasey]

of course it will. the referer is simple to fake, along with user-agent, etc. everything is simple to fake apart from your IP

[scorpion]

Unfortunately this is not true. I've discovered you need cURL for PHP. Just try it, the true referer always shows up if you use the php header construct...Unless you know another way to mask it?