Skip to content

Commit 60e7695

Browse files
[Challenges] Referer Header (#26222)
* update referer header issue description * wording + link * feedback
1 parent b585c88 commit 60e7695

File tree

1 file changed

+41
-3
lines changed
  • src/content/docs/cloudflare-challenges/troubleshooting

1 file changed

+41
-3
lines changed

src/content/docs/cloudflare-challenges/troubleshooting/index.mdx

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,47 @@ Challenges are not supported by Microsoft Internet Explorer. If you are currentl
2222

2323
### Referer header
2424

25-
When a request is sent with a referer header, the user will receive a Challenge Page as a response. Upon solving the Challenge Page, the request with the referer is sent to the origin, and the response to the request is served to the user. The JavaScript on the response page may read the value of `document.referer`, but it will be inaccurate. This affects tools such as Google Analytics, which reads the referer from JavaScript.
26-
27-
You can add tracking scripts to Challenge Pages to capture the correct referer header on the initial request.
25+
Your visitor's HTTP request contains a referer header set to the website that they came from. When they encounter and solve a Challenge Page, the request with the referer is sent to the origin, and the response to the request is served to the user. The JavaScript on the response page may read the value of `document.referer`, but it will not be accurate.
26+
27+
For example, a visitor coming from a given website is challenged by a [WAF rule](/waf/custom-rules/) via an interstitial Challenge Page served by your domain. Once the visitor loads the website's home page, the `document.referer` value is your domain, not the origin website.
28+
29+
This affects tools like Google Analytics, which reads the referer from JavaScript, since it replaces the previous website that visitors came from.
30+
31+
You can add tracking scripts, such as the Google Tag Manager Javascript, within an existing [Challenge Page](/rules/custom-errors/) to capture the correct referer header on the initial request.
32+
33+
```js title="Example JavaScript"
34+
<script>
35+
(function () {
36+
const gaIds = {
37+
"<YOUR_DOMAIN>": "<GA_TRACKING_ID>",
38+
};
39+
40+
const gaId = gaIds[window.location.hostname];
41+
42+
if (gaId) {
43+
const src = "https://www.googletagmanager.com/gtag/js?id=";
44+
45+
const gaScript = document.createElement("script");
46+
gaScript.src = src.concat(gaId);
47+
document.body.appendChild(gaScript);
48+
49+
window.dataLayer = window.dataLayer || [];
50+
function gtag() {
51+
dataLayer.push(arguments);
52+
}
53+
gtag("js", new Date());
54+
gtag("config", gaId);
55+
} else {
56+
console.warn(
57+
"Google Analytics ID not found for host:",
58+
window.location.hostname,
59+
);
60+
}
61+
})();
62+
</script>
63+
</body>
64+
65+
```
2866

2967
### Cross-origin resource sharing (CORS) preflight requests
3068

0 commit comments

Comments
 (0)