PHP: When submitting an HTML form, does the HTTP_REFERER get set?

Question

An exception was thrown in my application, but the HTTP_REFERER was null, which seems strange in this case. I'm wondering if you could answer a quick question:

So I've got this form:

<!-- mysite.com/index.html -->

<form action="http://mysite.com/somewhere/else">
    <input type="submit" />
</form>

When someone submits the form, I am expecting that the $_SERVER['HTTP_REFERER'] will be set to /index.html. Is that true?

Answer 1

$_SERVER['HTTP_REFERER'] is the value of the optional HTTP Referer header. This header is set by the browser.

The browser can opt to not set it or to lie about it, such as Firefox's RefControl addon does. Thus, you cannot rely on it to be present, or even accurate.

If a browser does give it, it will most likely not be /index.html, but rather http://www.mysite.com/index.html

Answer 2

Yes. I just tested it with both HTTP POST and GET and the Referer header was sent by the client (Google Chrome) both times.

This might be browser specific behaviour though.

EDIT:

In case anyone cares, here's a simple way to test it in PHP:

<?php
    echo $_SERVER['HTTP_REFERER'];
?>
<form method="post"><input type="submit" value="Submit"></form>
<form method="get"><input type="submit" value="Submit"></form>