Not so sure...
I just registered here because I'm interested in a similar topic.
However, if I understand correctly, this method is very easy to circumvent. You are essentially having the server check the REFERER as it is sent by the client. The problem is that the client can send whatever they want, even one of your "valid" REFERER values. Google for spoofing referer [sic] and you will break this kind of "security" in 5 minutes.
|