title: Spoofing HTTP Referrer data using ASP.NET
body: <p>Answers on here and various other sites are often full of warnings not to trust HTTP Referrer headers because they are 'so easily' spoofed or faked.</p>
  
  <p>Before I go any further - no, I'm not up to no good - but I do want to run some referrer-dependant tests.</p>
  
  <p>Whilst I don't doubt that the warnings about fake referrers are true, I can't really find much detailed info on <em>how</em> they can be manipulated. Even the <a href="http://en.wikipedia.org/wiki/Referrer_spoofing" rel="nofollow">Wikipedia article</a> only talks about it in general terms.</p>
  
  <p>I'm about to play with the <a href="https://addons.mozilla.org/en-US/firefox/addon/refcontrol/" rel="nofollow">RefControl addin</a> for FireFox. </p>
  
  <p>Programatically (in ASP.NET specifically) the <a href="http://msdn.microsoft.com/en-us/library/system.web.httprequest.urlreferrer%28v=VS.85%29.aspx" rel="nofollow">UrlReferrer</a> is a read-only property, so I don't see how I can fire off requests with fake referrer data if I can't set it? Do I really have to do it manually?</p>
  
  <p>How would I use ASP.NET to send a request to my site with a user-supplied variable to populate the referrer header?</p>
  
  <p><strong>EDIT :</strong> As per my comment below, I ideally want to take an incoming request, manupulate the referrer data and then pass the request on to another page, intact. If I can make it <em>appear</em> intact by building a new one from scratch and copying the original properties, then that is fine too.</p>