What would HTTP referrer be?

Question

What would the HTTP referrer be in the following cases:

1. User clicks a link on a website and arrives at a different website that is hot linking an image from a 3rd website, what would the referrer be on the image.
2. User clicks a link that goes to a different website that uses META Refresh to send them back to the first website.
3. User clicks a link that goes to a different website which contains an iframe to a second page on the second site, is the referrer the original site or the second site?

I cant seem to find an answer, If I cant get an answer here then i'll just make the pages and test it.

Answer 1

I am too lazy to try to interpret all given scenarios, but to help test things one can easily created a PHP script to return an image that tells us what the referrer is:

<?php
  header("Content-type: image/png");
  header("Cache-control: no-cache");
  header("Pragma: no-cache");
  header("Expires: -1");

  $s = "Referrer: " . $_SERVER['HTTP_REFERER'];

  $im = @imagecreate(500, 13)
    or die("Cannot Initialize new GD image stream");
  $black = imagecolorallocate($im, 0, 0, 0);
  imagecolortransparent($im, $black);
  $red = imagecolorallocate($im, 255, 0, 0);
  imagestring($im, 3, 0, 0, $s, $red);
  imagepng($im);
  imagedestroy($im);
?>

If a web site responds with a HTTP redirect, like 302 Moved Temporarily, then your browser will still send the original referrer with the redirected request:

<?php
  header("Location: http://[..]/referrer-to-img/referrer.php?redirected");
?>

Please note that, for example in Safari on a Mac, Command-click (to open a link in a new tab) and Command-Option-click (new window) do set the referrer for that link, while choosing "Open Link in New Tab/Window" from the context menu (after a right-click) does not.

Happy testing. ;-)

Answer 2

The Referer is always the document/resource that is referring to the current resource. So:

1. The URL of the document the image is hot-linked in.
2. Different from HTTP redirects, a META refresh will invoke the browser to send the URL of the document the META refresh is in.
3. Just like the image, the Referer will be the URL of the document that contains the frame.