标头未使用Referrer-Policy进行设置

Question

I have a domain lets say www.domain.com which i am redirecting to www.whatismyreferer.com to check referer. When i redirect page using PHP headers it shows No referer / hidden in result. I want to set referer as www.domain.com on whatismyrefer.com

Here is my code on the index.php file of www.domain.com:

<?php

header("Referrer-Policy: origin");
header("Location: https://www.whatismyreferer.com",true, 302);
?>

I have also tried referrer-policy: unsafe-url but still gets no referer

But if i use:

<meta name="referrer" content="origin">
<meta http-equiv="refresh" content="0;https://www.whatismyreferer.com">

then it shows referrer. I dont want to do it with meta tags, i want to do it with header location

Answer 1

I think the problem is probably how you are testing it. The 3xx redirect preserves the original Referer - the browser won't set a new Referer on the redirect itself. So, if you are directly requesting .index.php on your site (no referer) then there will also be no referer on the redirected request.

The meta refresh is not a 3xx HTTP redirect and behaves like you are following a regular anchor/link, so the browser generates a Referer.

Instead, you would need to test with a secondary file (eg. test-referer.html) that links to index.php in order to generate a Referer before testing your redirect/Referrer-Policy header.

<!-- test-referer.html -->
<a href="/index.php">index.php</a>

UPDATE:

The Referrer-Policy header works correctly for me when tested in this way.

I want to set referer as www.domain.com on whatismyrefer.com

In that case, you can't simply use 3xx HTTP redirects (without an initial referrer) because 3xx redirects don't themselves generate a referrer (as mentioned above). If 3xx redirects generated a Referer then sites would have problems with lost referrers all the time due to canonical redirects etc.

You will need to use a meta refresh (as you suggested) or perhaps a JavaScript "redirect" (untested). Or you could perhaps use CURL if the intention is to simply "fake" the Referer - although this won't directly result in a redirect.