What are the potential limitations of using $_SERVER["HTTP_REFERER"] to block direct links?

The potential limitation of using $_SERVER["HTTP_REFERER"] to block direct links is that it can be easily manipulated or spoofed by the user. To solve this issue, you can implement additional checks such as validating the source of the request or using session tokens to verify the authenticity of the referral. 

// Check if the request is coming from an allowed source
$allowed_sources = array('example.com', 'subdomain.example.com');
$referer = isset($_SERVER["HTTP_REFERER"]) ? parse_url($_SERVER["HTTP_REFERER"], PHP_URL_HOST) : '';
if(!in_array($referer, $allowed_sources)){
    // Redirect or display an error message
    header('Location: error.php');
    exit;
}

// Continue with the rest of your code

Keywords

$_SERVER["HTTP_REFERER"] limitations direct links blocking PHP

Related Questions