How to spoof http referer

As of current, are there still any methods to spoof HTTP referer?

Solution 1:

Yes.

The HTTP_REFERER is data passed by the client. Any data passed by the client can be spoofed/forged. This includes HTTP_USER_AGENT.

If you wrote the web browser, you're setting and sending the HTTP Referrer and User-Agent headers on the GET, POST, etc.

You can also use middleware such as a web proxy to alter these. Fiddler lets you control these values.

If you want to redirect a visitor to another website and set their browser's referrer to any value you desire, you'll need to develop a web browser-plugin or some other type of application that runs on their computer. Otherwise, you cannot set the referrer on the visitor's browser. It will show the page from your site that linked to it.

What might be a valid solution in your case would be for you to load the third party page on the visitor's behalf, using whatever referrer is necessary, then display the page to the user from your server.

Solution 2:

Yes, the HTTP referer header can be spoofed.

A common way to play with HTTP headers is to use a tool like cURL:

Sending headers using cURL: How to send a header using a HTTP request through a curl call?

or

The cURL docs: http://curl.haxx.se/docs/

Solution 3:

Yes of course. Browser can avoid to send it, and it can be also "spoofed". There's an addon for firefox (I haven't tried it myself) and likely you can use also something like privoxy (but it is harder to make it dynamically changing). Using other tools like wget, is as easy as setting the proper option.