What are potential issues with using HTTP_REFERER in PHP for redirecting users?

Using HTTP_REFERER for redirecting users can be unreliable as it relies on the HTTP Referer header, which can be easily spoofed or disabled by the user's browser. To improve reliability, consider using session variables or form tokens to track user navigation instead. 

<?php
session_start();

if(isset($_SESSION['redirect_url'])) {
    $redirect_url = $_SESSION['redirect_url'];
    unset($_SESSION['redirect_url']);
    header("Location: $redirect_url");
    exit;
}

// Redirect user to another page
$redirect_url = "example.php";
$_SESSION['redirect_url'] = $redirect_url;
header("Location: $redirect_url");
exit;
?>

Keywords

HTTP_REFERER PHP redirecting security vulnerability

Related Questions