Pass HTTP Referer with Loader load()

Question

I need to set a value for the Referer header when making a request to my local proxy script from Flash. As recommended in this question: Facebook Proxy Loader Security, I need to check the HTTP_REFERER to test if traffic is coming from my own domain. The problem is that when using a loader like the code below, no Referer header is sent.

package com.utils.loaders {
    import flash.net.URLVariables;
    import flash.net.URLRequest;
    import flash.display.Loader;

    public class FacebookProxyLoader extends Loader
    {
        protected static const PROXY_SCRIPT :String = "includes/facebookproxyloader.php";

        public function FacebookProxyLoader():void      
        {           

        }

        public function proxyLoad(url:String):void
        {   
            var request:URLRequest = new URLRequest(PROXY_SCRIPT);
            var variables:URLVariables = new URLVariables();    
            variables['path'] = url;
            request.data = variables;
            super.load(request);
        }
    }
}

According to the Flash docs: http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/net/URLRequestHeader.html there is only very limited support for HTTP headers in Flash Player, and Referer is prohibited. Is there anything I can do here other than have my proxy check that $_SERVER['HTTP_REFERER'] is empty? (and that seems like a fairly large hole in security right there)

Dennis Jaamann Dennis Jaamann · Accepted Answer · 2011-05-20T09:35:15

Though I'm not sure you could try to use a BlazeDS proxy and setting it up to only accept incoming requests from your domain?

You would have to rewrite your the code from your php proxy in java then though.

Cheers

Pass HTTP Referer with Loader load()

2 Answers