Background: I need to set HTTP_REFERER for a 3rd party store to recognize that the user of their store is coming from my page.
Issue: Users authenticate, which is secured over HTTPS. When sending the user from HTTPS to the HTTP custom store, standard security behavior of web browsers kick in and the HTTP_REFERER is lost.
Coming from HTTPS, is there any way to set the HTTP_REFERER value reliably?
When you use CURL, the headers you set using it are only used by CURL’s own request functionality. It has absolutely no effect on the user’s browser.
The same with
header(). It will only set response headers to the current request from the user’s browser.There is no way to set the referrer header the user’s browser should use in the next request from PHP.
Assuming you were to perform the entire request using CURL, and then echoing the results of the request, it should work. But besides that, no.