Adobe Flash Player addon for Mozilla Firefox does not send HTTP referrers.

This is a public notification for web developers, something I discovered, tested and confirmed across multiple platforms and reproduced multiple times.

Behavior Observed: Adobe Flash Player addon for Mozilla Firefox does not send HTTP referrers.
This was discovered when trying to troubleshoot a client’s hotlink protection to their band’s MP3 files. They were linking to the mp3 files from their own domain name, from inside of a .swf hosted on the same domain name (including subdomain) as the target content. Even though the .swf linking to the files and the destination files were in the same directory, and domain, hotlink protection (.htaccess rules setup to prevent outside direct linking to the files) prohibited the legitimate HTTP requests from going through. Rather, the server will respond with a 403 error.

Scope of Issue: Using .swf files viewed or rendered inside of Adobe’s official Flash Player plugin for Mozilla Firefox, while implementing some type of referrer check on the target web server.

Possible Workaround: Use an alternate .swf rendering plugin for Mozilla Firefox. A few exist for the Linux graphical environments, however no known alternates exist for Microsoft Windows users. The praticality of this work around is limited at best.

Another work around would be to use actionscript inside of the .swf which would manipulate the headers sent to the webserver, to include the referrer. This would require modification of the swf by the swf author / editor / developer.