Question

In my app, I allow the user to open up an external page in an embedded UIWebView. Is it possible for me to set the referer header that’s sent with that request? I’d like for my app to get the ‘cred’ when the user opens up these external pages.

Answer 1

Set the referer using – setValue:forHTTPHeaderField:

NSMutableURLRequest* request = ...;
[request setValue:@"https://myapp.com" forHTTPHeaderField: @"Referer"];

But note that according to the HTTP RFC you shouldn’t, because your app is not addressable using a URI:

The Referer field MUST NOT be sent if the Request-URI was obtained
from a source that does not have its own URI, such as input from the
user keyboard.

… unless you are using a custom protocol binded to your app (myapp://blah.com/blah).

You can create one and call loadRequest: manually or intercepting a normal request made by the user.

- (BOOL) webView:(UIWebView*)webView shouldStartLoadWithRequest:(NSURLRequest*)request navigationType:(UIWebViewNavigationType) navigationType 
{
    NSDictionary *headers = [request allHTTPHeaderFields];
    BOOL hasReferer = [headers objectForKey:@"Referer"]!=nil;
    if (hasReferer) {
        // .. is this my referer?
        return YES;
    } else {
        // relaunch with a modified request
        dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
            dispatch_async(dispatch_get_main_queue(), ^{
                NSURL *url = [request URL];
                NSMutableURLRequest* request = [NSMutableURLRequest requestWithURL:url cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:60.0];
                [request setHTTPMethod:@"GET"];
                [request setValue:@"https://whatever.com" forHTTPHeaderField: @"Referer"];
                [self.webView loadRequest:request];
            });
        });
        return NO;
    }
}