HTTP referer

HTTP referer (originally a misspelling of referrer) is an HTTP header field that identifies the address of the webpage (i.e., the URI or IRI) that linked to the resource being requested. By checking the referer, the new webpage can see where the request originated. In the context of the World Wide Web, it is a mechanism to track which webpages link to each other, and it plays a crucial role in analyzing web traffic, enhancing security measures, and personalizing content for users.

Overview

The HTTP referer header was introduced in HTTP 1.0. Its purpose is to allow a server to identify where people are visiting from, or more specifically, the last page the user was on (the one where they actually clicked the link). This can be useful for various reasons, such as to track how traffic flows through a website, to protect against Cross-Site Request Forgery (CSRF) attacks by verifying the origin of requests, or to tailor responses based on the referring URL.

Functionality

When a user clicks a hyperlink in a web browser, the browser sends a request to the server hosting the target page. This request can include a referer header, which indicates the last page the user was on (the referer). Not all requests include this header; for example, browsers do not send the referer header when navigating from a secure site (HTTPS) to a non-secure site (HTTP) to protect user privacy.

Privacy Concerns and Security

The referer header can potentially leak sensitive information through URLs, such as session IDs or other private data. As a result, websites must be cautious about the information included in URLs. Additionally, modern web browsers and the introduction of the Referrer-Policy HTTP header allow websites to control the amount of information that should be included in the referer header to mitigate privacy concerns.

Referrer-Policy

The Referrer-Policy header allows a web server to instruct the browser on how to handle referer information. Options include not sending the referer header, sending it only for same-origin requests, or stripping it down to the origin. This flexibility helps balance the needs for privacy and the utility of the referer header.

Applications

Beyond security and analytics, the referer header is used in various applications, including:

• Affiliate marketing: to track the origin of traffic and attribute sales or conversions.
• Ad serving: to customize advertisements based on the content of the referring page.
• Website optimization: to understand user navigation paths and improve site architecture.

Limitations and Alternatives

While useful, the referer header is not completely reliable. Users or browsers can modify or block the referer for privacy reasons, and some firewalls and proxies strip this information from requests. Alternatives and complements to the referer header, such as tracking pixels, cookies, and other analytics tools, are often used to gather similar information more reliably.

See Also

• Web analytics
• Cross-site scripting
• Internet privacy
• Uniform Resource Identifier