field Registered
Verified 2026-09-18 · registry updated
2026-08-28Referer
Carries the previous page address that led to a request.
Referer is intentionally misspelled in the protocol. Control how much it reveals with Referrer-Policy and do not put secrets in URLs.
httpheaderprivacysecurity
Reference (http)
Referer: https://www.example.com/account
Referer is intentionally misspelled in the protocol. Control how much it reveals with Referrer-Policy and do not put secrets in URLs.
Common mistakes
- Assuming Referer is always present or treating it as a trustworthy CSRF proof.
IANA registry: http-fields/field-names
Registry reference: RFC 9110, Section 10.1.3: HTTP Semantics