$_SERVER['HTTP_ORIGIN'] doesn't work

Question

When I use $_SERVER['HTTP_ORIGIN'].

echo $_SERVER['HTTP_ORIGIN'] ;

Return Notice: Undefined index: HTTP_ORIGIN in D:\xampp\htdocs\safe\test.php on line 12

What is Wrong?!

Unterwalden

What is Wrong?! Using HTML snippets to display PHP code is wrong. – Loar

It just mean that the Origin header has not been provided when the page was requested. – Faradmeter

what are you using it for? perhaps we can suggest an alternative approach. – Moire

It's because your browser not send origin request. so the php not send response the origin. – Eye

use if(isset($_SERVER['HTTP_ORIGIN'])){ echo $_SERVER['HTTP_ORIGIN']; } – Eye

Answer 1

The Origin header isn't sent by all browsers.

Depending what you're trying to do, another option is to use the Referer header:

echo $_SERVER['HTTP_REFERER'];

By the way, note that request headers are ultimately controlled by the user, so can't be fully trusted.

Loar

as long as you dont trust HTTP_REFERER as it is set by the browser. can be faked, or often emptied by various software for security – Moire

More Info Here about it https://mcmap.net/q/18434/-how-secure-is-http_origin – Caresa

@Dagon I demand an upvote! :P just kidding, as this is as bad as asking money to strangers – Loar

@Dagon Why extra software dude? Why not Firebug, Developer Tools? They are capable of emulating, simulating, confusing, collapsing and finally, crashing the server. – Loar

I meant some software a user may run may automatically empty it. i have seen various "internet security" software people run on their PC do this. – Moire

@Dagon Even I am doing it. OWASP? TamperHTTP? There are 1000s. But what I meant was, even the Chrome F12 Dev tools are capable of doing it. – Loar

i think we agree. – Moire

I use a SoapClient to another server and I want know Who's request – Unterwalden

@smko SOAP Client huh? You need to provide more information dude. – Loar

I want to each site, which will be submitted information related to the site . But I know exactly the same site that will be submitted, and it is not Api someone else ? – Unterwalden

@PraveenKumar Please review this answer, or even delete it, as it's misleading. – Natter

@PedroLobito Sure, thanks for getting this to me... :) – Loar

@PedroLobito I guess either if you can update the answer as per the latest standard, or I'll just delete it... :) – Loar

@PraveenKumar There never was a secure way of using HTTP_REFERER as it can be easily spoofed. I'd delete the answer. – Natter

How is either header "insecure"? Sure, they can be spoofed by a client, but they can't be overidden by browsers as they are forbidden headers, which is good enough for many use cases. This answer needs to clarify that. – Bioscope

@Bioscope You know that the answers are licensed under CC BY-SA. You can very much edit and update it and I would have happily accepted it rather than complaining. It is this quality that makes a better leader. Anyway, thanks, I've updated it. – Loar