Why does $_SERVER['HTTP_REFERER'] still show original referrer?
<p>I am trying to spoof referrer.</p>

<p>A.com --> B.com --> Destination.com</p>

<p>A.com I have</p>

<pre><code>header("Location: http://B.com/redirect.php?site='http://destination.com'");
</code></pre>

<p>B.com I have</p>

<pre><code>$target = $_GET['site'];
header("Location: $target");
</code></pre>

<p>Destination.com writes the <code>$_SERVER['HTTP_REFERER'];</code> to a database where I can confirm if the refer spoof worked.</p>

<p>However, database shows that referer is A.com not B.com ! Where did I go wrong ?</p>
