title: Is HTTP_REFERER supposed to be filled in when user tells a browser to "refresh"?
body: <p>I'm trying to use a referrer header check as a defence in depth (i.e. one of many security techniques while note solely relying on any one alone).</p>
  
  <p>It seems that sometimes MSIE doesn't include the referrer on refresh.  Is that expected behavior?  Is there anyway I can detect refresh, so I that I know that a missing referrer is ok?</p>
  
  <p>And yes, I know that referrers can be spoofed with custom browsers.  Just saying, if a hacker does want to hack my little site, he will need to invest the time to set up an appropriate referrer.</p>