CODEWITHSUNDEEP
phphttp
saibbyweb
saibbyweb

Reputation: 3264

Is HTTP REFERER safe enough?

I have a PHP file which contains some important data of my website. I have set up the below written HTTP REFERER script in that file. For now its only accessible when redirected from a specific page of my website backend (which is password protected). Is it safe to assume that this file cannot be accessed by any other means? 

<?php
    if ($_SERVER['HTTP_REFERER'] == "http://yoursite.com/IMPORTANT_FILE.php") {
        // continue
    } else {
        header("Location: http://yoursite.com/");
        exit(); //Stop running the script
        // go to form page again.
    }
?>

Upvotes: 0

Views: 480

Answers (1)

John Conde
John Conde

Reputation: 219934

No. $_SERVER['HTTP_REFERER'] can be spoofed so it cannot be relied upon for safety or accuracy. This chrome extension makes it trivial for a newbie to do.

A better way to do this is authenticate your users before they attempt to access your protected files. Only after passing this authentication can they access them. See this answer for an example.

Upvotes: 6

Related Questions