nullreferering

Nullreferering, or null referer, refers to HTTP requests where the Referer header is either absent or contains the literal value "null". The Referer header is used to indicate the URL of the page that linked to the requested resource. When the header is missing or explicitly set to "null", it provides no origin information about the caller.

Causes of null referer include privacy-focused browser behavior and deliberate policy settings. Modern browsers can suppress or replace the Referer header according to the Referrer-Policy in effect. Navigating from certain schemes or environments, such as local files (file://) or content with strong privacy restrictions, often results in a null referer. Some environments may also normalize or strip referer data to protect user privacy during cross-origin requests or downgrades from HTTPS to HTTP.

Implications of null referer vary by context. For analytics and attribution, a null referer makes it harder to determine where traffic originated. For security, some server-side checks that rely on the Referer header for CSRF protection may be less effective, though modern CSRF defenses rely on tokens and same-site cookies rather than referer alone. Websites should not rely on the presence of a referer for authentication or access control and should handle missing or null values gracefully.

Mitigation and best practices include configuring the Referrer-Policy header to express clear intent (for example, no-referrer, origin, or strict-origin-when-cross-origin) and implementing robust security measures not dependent on the Referer header. Developers should test behavior across browsers and platforms to ensure expected handling of null referers and to avoid unintended privacy or security gaps.

See also: Referer header, Referrer-Policy, cross-origin resource sharing, CSRF protection.