I'm trying add a simple template to CMS page using a block type from a local module. This template will rely on http_referer and request params.

In the Design > Layout Update XML part of the CMS page, I added

<reference name="content">
    <block type="gbicm/modal" name="gbicmmodal" template="gbicm/modal.phtml" />

To start, the template calls $this->method() which simply returns $_SERVER["HTTP_REFERER"] for testing, but it is returning null in all cases. I've created a link to this page from another cms page, and when I click the link it returns null. I haven't tried using a controller class to get it, because I can't find any examples that do this from a block class.

Am I going about this incorrectly? Does $_SERVER["HTTP_REFERER"] not function in a block class? Can I access a controller/router class/singleton to get request information?

Update: Mage::helper('core/http')->getHttpReferer() gives me empty string when I land on the cms page from a link in another page.


Try using Mage::helper('core/http')->getHttpReferer() Anyway, first try to return a string from your method since I think the issue you are experiencing is there and not in the $_SERVER["HTTP_REFERER"] part.

  • The method returns a string literal fine. Mage::helper('core/http')->getHttpReferer() is returning empty strings for me, when I land on this page via a link from another page. May 13 '15 at 21:31
  • I voted you up for showing me the "Magento way" of getting http_referer though. May 13 '15 at 21:42
  • What happens if you put the code I have you in the phtml?
    – mbalparda
    May 13 '15 at 21:51
  • Empty strings . May 13 '15 at 22:24

Find an alternative to HTTP_REFERER it's not reliable.

Using HTTP_REFERER isn't reliable, it's value is dependent on the HTTP Referer header sent by the browser or client application to the server and therefore can't be trusted.

Regarding the Referer header, section 15.1.2 of RFC2616 states:

Therefore, applications SHOULD supply as much control over this information as possible to the provider of that information. and

We suggest, though do not require, that a convenient toggle interface be provided for the user to enable or disable the sending of From and Referer information. Many online privacy tools mangle this value and many browsers such as FireFox have for a long time permitted users to prevent this header being sent. So in a nutshell, I wouldn't rely on it for any serious purpose. For example, securing forms so that drive-by spammers can't post values, because the Referer can be spoofed.

  • It's okay if it's not reliable. There is no security risk. My browser is sending the header. When I echo $_SERVER["HTTP_REFERER"] from /test.php, and access via link on cms page /test2, I get: http://stage.example.com/test2 May 13 '15 at 22:37
  • Reliable as in not security wise, but the fact the value is user agent dependant, you'll get some browsers it will work fine in and others it won't. stackoverflow.com/questions/6880659/…
    – B00MER
    May 13 '15 at 22:52
  • Thanks B00MER. I'd still like to know how, if possible, to access this from the block level in Magento. My browser is sending the header, so does it get cleared at some point? Does Magento store it somewhere that I can access? May 14 '15 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.