JavaScript [removed] does not set referer in the request header

Question

I understand relying on Referer in the request header is not right. But my question is, why IE does not set Referer to the Request Header if I use window.location

Answer 1

I don't have enough points to comment on Evan's answer to suggest a correction so all I can do is post the correction here. In short, document.createElement(a) is missing quotes and should be document.createElement("a") instead. This should fix Kevin's concern about FF5 as well.

The whole function as I wrote it:

function goTo(url)
{
    var a = document.createElement("a");
    if (a.click)
    {
        // HTML5 browsers and IE support click() on , early FF does not.
        a.setAttribute("href", url);
        a.style.display = "none";
        document.body.appendChild(a);
        a.click();
    } else {
        // Early FF can, however, use this usual method
        // where IE cannot with secure links.
        window.location = url;
    }
}

This works in our HTTPS environment with IE7, IE8, FF3, FF7, and Chrome. So I imagine it works in FF5 as well. Without this workaround we get 403 errors in IE7 and IE8 when trying to set window.location. Regarding Sha Le's question as to why IE does this, I can only guess is that they believe it to be too insecure. I had a similar problem with window.open in IE that I had to work around as well.