Is it possible to remove the referrer in PHP before redirected?

Question

But since the browser is the only thing that manages the referrer, however I was thinking about a script that removes the referrer before they are redirected to the link they want to go to.

For example,

http://mywebsite.com/url.php?u=http://www.stackoverflow.com

Where url.php could remove the referrer and then redirect. Is it possible to do this in any way?

Answer 1

You can actually do this in practice if you're running HTTPS on your webserver. You need to force the connection to go via HTTPS as an intermediary so the sequence of redirects would then be:

1. http://mywebsite.com/url.php?u=http://www.stackoverflow.com ->
2. https://mywebsite.com/url.php?u=http://www.stackoverflow.com ->
3. http://stackoverflow.com

Most browsers don't send a referrer in cases like that to avoid leaking information that was private and encrypted over insecure channels to unrelated third parties.

---

Newer browsers now support this properly anyway, with a meta tag. You can add:

<meta name="referrer" content="never">

Generally though you should be setting this option on all your pages anyway, so both client and server side redirection would be fine.