Page History

...

• For example, open redirect vulnerabilities can be used to exploit GET-based requests that are protected with a referer check 
  • Does this mean someone can take advantage of a browsers broken redirect behaviour to make the referer header set to the wrong value?
  • ????
• and some organizations or browser tools remove referrer headers as a form of data protection.
  • This is OK. That organization would have to turn the referrer headers back on.
• There are also common implementation mistakes with referer checks. For example if the CSRF attack originates from an HTTPS domain then the referer will be omitted. In this case the lack of a referer should be considered to be an attack when the request is performing a state change.
  • True HTTPS to HTTP strips the header.
  • Can we We simply consider all requests with no referrer to be an attack?What is this implying about HTTPS requests? Is the Referrer header not included? Is it not readable on the server?.
    
    

...

If a website is accessed from a HTTP Secure (HTTPS) connection and a link points to anywhere except another secure location, then the referer field is not sent.^{[9] "Clients SHOULD NOT include a Referer[sic] header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol"}

FYI: Meta tag referrer

http://smerity.com/articles/2013/where_did_all_the_http_referrers_go.html

...