Setting the ‘Referer’ Header Using JavaScript

This blog post demonstrates a practical JavaScript technique that fakes the HTTP Referer header by modifying the browser history (pushState/replaceState) before issuing requests, enabling attackers exploiting XSS to make actions appear to come from legitimate pages; it includes example payloads, mitigation notes (limitations such as URL encoding and visible URL change), and links to code and prior related resources.