According to conventional wisdom, forcing a browser to set the Referer HTTP Request header is more or less impossible. I know that I cannot do it from server-side, and I cannot find any solutions client-side (via JavaScript).

I use Firefox which pretty much guarantees that with every page request I send, the Referer header is absolutely not sent. However, when I navigate to my Magento site and then look at the request headers (listed by the LiveHeaders addon), right there it has the Referer header set.

How exactly does Magento accomplish this? I'm not looking for an explanation on which modules/models/library objects are responsible for this. I would like to know what base mechanism they are exploiting(?) to achieve it? It absolutely baffles me!

The only way I can see them accomplishing this is that for every HTTP request a Magento web server receives, it does an internal redirect to the same page but with some added headers (like Referer), and then returns THAT response.

Other than that, I have no clue how those guys do this?

  • 1
    Sorry for the lack of tags. Version was the only thing the site would allow me. Meaningful things like 'referer', 'http', 'request', etc. are reserved for people who can actually create tags. My rep is too low for me to be able to communicate effectively. Commented Dec 28, 2013 at 3:17

2 Answers 2


Magento uses the PHP server array value HTTP_REFERER for this, see Mage_Core_Controller_Varien_Action::_getRefererUrl() where the referer is captured.

According to the HTTP Wiki this is handled by the browser adding it for every request:

HTTP referer (originally a misspelling of referrer) is an HTTP header field that identifies the address of the webpage (i.e. the URI or IRI) that linked to the resource being requested. By checking the referer, the new webpage can see where the request originated.

In the most common situation this means that when a user clicks a hyperlink in a web browser, the browser sends a request to the server holding the destination webpage. The request includes the referer field, which indicates the last page the user was on (the one where they clicked the link).


Your problem here appears to be your assumption that

I use Firefox which pretty much guarantees that with every page request I send, the Referer header is absolutely not sent.

This is incorrect. When you click on a link in most browsers, (including Firefox), it will send a referrer header along with the request. Magento isn't doing anything special, it's just relying on plain old HTTP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.