72

I want to set Referer header of my webpage. Currently it displays "xyz" and I want to set it to "abc".

Viewed referer using javascript:alert(document.referer)

6
  • 1
    This has been asked before: stackoverflow.com/questions/220231/…
    – Tieson T.
    Mar 6, 2012 at 9:04
  • 7
    @TiesonT. Actually, that question is about accessing HTTP headers, not about overriding the Referer header. Mar 6, 2012 at 9:07
  • 1
    @MathiasBynens Fair enough, but you can't change something you can't access, right? :)
    – Tieson T.
    Mar 6, 2012 at 9:12
  • 1
    You can't, document.referrer is a read-only property, which value changes only when picking a link. If this picked link is on a security site, an empty string is assigned.
    – Teemu
    Mar 6, 2012 at 9:22
  • @T.J.Crowder Both reasons :) Forgetting to accept answers sometimes and sometimes I do not get acceptable answers Mar 6, 2012 at 9:31

9 Answers 9

57

You can use Object.defineProperty on the document object for the referrer property:

Object.defineProperty(document, "referrer", {get : function(){ return "my new referrer"; }});

Unfortunately this will not work on any version of safari <=5, Firefox < 4, Chrome < 5 and Internet Explorer < 9 as it doesn't allow defineProperty to be used on dom objects.

5
  • 1
    Works also. Prefer this to @casivaagustin's answer though his works also
    – Ema4rl
    Jan 27, 2016 at 14:57
  • With this method I get an error in Safari 9: "TypeError: Attempting to change the getter of an unconfigurable property."
    – jthomas
    Jul 26, 2016 at 15:20
  • 1
    If you want to change it in tests and want to redifine the referrer in multiple test cases, use ``` Object.defineProperty(document, 'referrer', { configurable: true, get: () => url, }); ```
    – manohar
    Aug 18, 2018 at 13:56
  • 10
    It sets the object property but isn't set in request headers Dec 13, 2018 at 14:44
  • Noob here. Would this line go inside <script/>? Is it to be called within an event like onload or document.ready?
    – Sagar
    Jan 29, 2021 at 4:51
37

You cannot set Referer header manually but you can use location.href to set the referer header to the link used in href but it will cause reloading of the page.

3
  • 1
    thanks it changes the referer but it changes the URL of selenium server So i consider that it is impossible to change the referer Mar 7, 2012 at 8:06
  • 4
    @ABG Any chance you can write a bit more about how your answer materializes in code? E.g. a short javascript snipping or HTML snippet?
    – qxotk
    Oct 18, 2013 at 20:48
  • 2
    @jsmcfrind A bit late, but if you just do window.location.reload() this will cause the page to reload and if you check document.referrer it should be equal to the current page instead of whatever it may have been before. Tried creating a test case in jsfiddle but failed because of the sandbox nature of the website. (Though I did create a somewhat amusing recursive jsfiddle in the process.) Dec 2, 2014 at 17:29
24

This works in Chrome, Firefox, doesn't work in Safari :(, haven't tested in other browsers

        delete window.document.referrer;
        window.document.__defineGetter__('referrer', function () {
            return "yoururl.com";
        });

Saw that here https://gist.github.com/papoms/3481673

Regards

test case: https://jsfiddle.net/bez3w4ko/ (so you can easily test several browsers) and here is a test with iframes https://jsfiddle.net/2vbfpjp1/1/

4
  • but how about when a user tries to access a new site ??? for example there is a link on site1.com that redirect user on site2.com May 30, 2016 at 14:14
  • doesn't add referral domain "yoururl.com" Oct 26, 2016 at 6:00
  • 5
    @Brandito It didn't work, the value has changed, but when you send a request such as image, you can find the referrer is still the old one.
    – chenkehxx
    May 8, 2018 at 13:41
  • I can confirm it works in Safari 13. But I had to use location.reload(); afterwards.
    – D. Jones
    Dec 1, 2019 at 11:53
8

I think that understanding why you can't change the referer header might help people reading this question.

From this page: https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name

From that link:

A forbidden header name is the name of any HTTP header that cannot be modified programmatically...

Modifying such headers is forbidden because the user agent retains full control over them.

Forbidden header names ... are one of the following names:

...

Referer

...

4

You can not change the REFERRER property. What you are asking is to spoof the request.

Just in case you want the referrer to be set like you have opened a url directly or for the fist time{http referrer=null} then reload the page

location.reload();
2
  • this only remove referrer header. doesn't add custom header Oct 26, 2016 at 6:01
  • Right. the question isnt about adding the custom header.
    – Vaibs
    Feb 22, 2017 at 14:24
3

If you want to change the referer (url) header that will be sent to the server when a user clicks an anchor or iframe is opened, you can do it without any hacks. Simply do history.replaceState, you will change the url as it will appear in the browser bar and also the referer that will be send to the server.

1
2

Above solution does not work for me , I have tried following and it is working in all browsers.

simply made a fake ajax call, it will make a entry into referer header.

var request;
if (window.XMLHttpRequest) { // Mozilla, Safari, ...
    request = new XMLHttpRequest();
} else if (window.ActiveXObject) { // IE
    try {
        request = new ActiveXObject('Msxml2.XMLHTTP');
    } catch (e) {
        try {
            request = new ActiveXObject('Microsoft.XMLHTTP');
        } catch (e) {}
    }
}
request.open("GET", url, true);
request.send();
1
  • 1
    how i should try this ? can you please provide me steps for this as i used many ways to change referrar header but nothing works ? Oct 26, 2016 at 6:01
0

You can change the value of the referrer in the HTTP header using the Web Request API.

It requires a background js script for it's use. You can use the onBeforeSendHeaders as it modifies the header before the request is sent.

Your code will be something like this :

    chrome.webRequest.onBeforeSendHeaders.addEventListener(function(details){
    var newRef = "http://new-referer/path";
    var hasRef = false;
    for(var n in details.requestHeaders){
        hasRef = details.requestHeaders[n].name == "Referer";
        if(hasRef){
            details.requestHeaders[n].value = newRef;
         break;
        }
    }
    if(!hasRef){
        details.requestHeaders.push({name:"Referer",value:newRef});
    }
    return {requestHeaders:details.requestHeaders};
},
{
    urls:["http://target/*"]
},
[
    "requestHeaders",
    "blocking"
]);

urls : It acts as a request filter, and invokes the listener only for certain requests.

For more info: https://developer.chrome.com/extensions/webRequest

3
  • 1
    any chance of a better example? where am i suppose to paste this?
    – Toolkit
    Nov 20, 2017 at 15:39
  • You are supposed to create a background script and paste it in that file. Be sure to add the file as a background script in your manifest.
    – Nalin
    Dec 21, 2017 at 18:16
  • This answer is valid if you are writing a chrome extension. - If your clients / users accepts to install it - Or if you are doing something at home for your own use and ready to install your own extension. Jan 16, 2020 at 20:21
0

If you need to set it from google or any other website that links to your website and be sure, google or that website is the referrer value, you may follow these instructions:

  1. Go to google.com
  2. Type site:mywebsiteexample.com
  3. After finding it, right click and inspect
  4. On the top right of the screen, you may find a cursor to select what part of the DOM you want to select and inspect. Select the anchor. Modify the href value to the link you want. Then hit enter.

After clicking the anchor, it should redirect to your link or page and the referrer value should be in this case from google.com or the website you've decided

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.