I know this is actually more a PSR7 question, but can anyone tell me why the HTTP_REFERER HTTP header isn’t (better) exposed in the Request object?
1 Like
I don’t know. However given that HTTP_REFERER is untrustworthy, it’s not especially important as it’s rarely used.
Rob, yeah, I was thinking it’s one of the easy-to-spoof headers, so perhaps that’s why. I could see some use in it in some cases though (e.g. when there is no security concern, and/or the referring URI is under my own control).