Problem setting "Referer" header about httr HOT 3 CLOSED

I'm pretty sure that this is an https security thing - https requests do not include referers.

from httr.

You're right in that the relevant RFC prohibits passing of a Referer header from an HTTPS to an HTTP url. However, part of the CSRF protections included in the Django web app framework include strict HTTPS referer checking ( see: https://docs.djangoproject.com/en/dev/ref/contrib/csrf/ ):

"In addition, for HTTPS requests, strict referer checking is done by CsrfViewMiddleware. This is necessary to
address a Man-In-The-Middle attack that is possible under HTTPS when using a session independent nonce,
due to the fact that HTTP ‘Set-Cookie’ headers are (unfortunately) accepted by clients that are talking to a site
under HTTPS. (Referer checking is not done for HTTP requests because the presence of the Referer header is
not reliable enough under HTTP.)"

I haven't dug into the code, but I imagine the filter you're referring to would be somewhere in the RCurl package. I'll try to hack around it :-)

from httr.

It might actually be built into curl - I'd see if you can repeat the behaviour from the command line. But it's possible what you are trying to do is exactly what django is trying to stop you from doing ;)

from httr.