What are the potential pitfalls of relying on the HTTP_REFERER value in PHP?

Relying on the HTTP_REFERER value in PHP can be risky as it can be easily manipulated by the user or may not be present in certain situations (such as when navigating from HTTPS to HTTP). To mitigate this risk, you can use a more secure method of verifying the origin of the request, such as using CSRF tokens. 

// Verify CSRF token instead of relying on HTTP_REFERER
session_start();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        // Invalid CSRF token
        die('Invalid CSRF token');
    }

    // Proceed with processing the form data
}

// Generate and store CSRF token
$csrf_token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $csrf_token;

Keywords

HTTP_REFERER security vulnerability cross-site request forgery user input validation server-side validation

Related Questions