is $_SERVER['HTTP_REFERER'] safe?

Question

I'm using $_SERVER['HTTP_REFERER'] to generate a dynamic back link.

<a href="<?php echo $_SERVER['HTTP_REFERER'] ?>">Return to..blah</a>

Is it reasonably safe to do so?

Answer 1

Not like that.

It might not be present. (It might be wrong, some personal firewall packages obfuscate the referer for privacy reasons, violating the HTTP spec along the way)

You should run anything coming from outside your system through htmlspecialchars to guard against XSS attacks (although, IIRC, the referer should never have any dangerous characters in it as they should be URL safe you should keep in the habit of always being cautious).

Browsers come with back buttons though, there is no need to try to duplicate their functionality (especially when, with this, if the user clicks a link marked "back" it doesn't take them back in their history, so clicking the normal back button will conceptually take them forwards).

Answer 2

It may be safe, but it is not reliable: due to the HTTP spec, HTTP_REFERER is optional (some clients don't send this header at all, and some "security" software strips this out from any HTTP request), and there are numerous ways to modify this header. Some browsers send the referring page, some send a blank string, some don't send this at all, some may send bogus data, some may send Aunt Matilda; and moreover, you can't tell whether you're getting valid data in this header or not.

So, no, I would never trust that HTTP_REFERER contains the previous page, and neither should you.