Re: Include Referer-HTTP-header in requests from XMLHttpRequests

"Mark Nottingham" <mnot@yahoo-inc.com>
> If I can't trust XHR to send a referer, I have to allow all requests,  and 
> that means that -- today -- somebody can link to that content  from 
> another site using <a>, <script>, <object>, etc.

No, you set appropriate header to authorise the request, you don't rely on 
referer, as that is unsafem because it's unreliable and you would 
unreasonably disqualify people from using your service.

Given the existence of better methods of meeting your use case, I see no 
reason to raise Referer up to should.

Jim.