How can PHP compare the HTTP_HOST and HTTP_REFERER headers for security purposes?

To compare the HTTP_HOST and HTTP_REFERER headers for security purposes, you can check if the HTTP_REFERER header matches the expected value based on the HTTP_HOST header. This can help prevent spoofing attacks where an attacker tries to trick a user into visiting a malicious website. 

if(isset($_SERVER['HTTP_HOST']) && isset($_SERVER['HTTP_REFERER'])){
    $expected_referer = 'http://' . $_SERVER['HTTP_HOST'];

    if($_SERVER['HTTP_REFERER'] !== $expected_referer){
        // Redirect or block the request
        header('HTTP/1.1 403 Forbidden');
        exit;
    }
}

Keywords

PHP HTTP_HOST HTTP_REFERER security comparison

Related Questions