$ua->default_header('Referer' => "http://www.perlmonks.org");
[download]

You can set the Referer in the HTTP::Request object:

use HTTP::Request;
use LWP::UserAgent;
                                                                      
+          
my $agent = LWP::UserAgent->new();
                                                                      
+          
my $req = HTTP::Request->new(GET => 'http://localhost' );
                                                                      
+          
$req->referer('http://localhost/');
                                                                      
+          
my $response = $agent->request($req);
[download]

/J\

  # Create a user agent object
  use LWP::UserAgent;
  $ua = LWP::UserAgent->new;
  $ua->agent("ima User Agent");

  # Create a request
  my $req = HTTP::Request->new(GET => 'http://www.google.com');
  $req->header(Accept => "text/html, */*;q=0.1", referer => 'http://ww
+w.test.com/);

  # Pass request to the user agent and get a response back
  my $res = $ua->request($req);

  # Check the outcome of the response
  if ($res->is_success) {
      print $res->content;
  }
  else {
      print $res->status_line, "\n";
  }
[download]

Anyway, WWW::Mechanize is a subclass of LWP::UserAgent, so chances are reasonable that low level stuff from WWW::Mechanize will work with LWP::UserAgent, or that you can use WWW::Mechanize in stead of LWP::UserAgent.

OK, I can think of legit reasons but I can also think of lots of blackhattery, chapeau-noir, etc for which this information might be potentially used.

update Fletch and Joost make valid points below. Guess that all that's left in defense (and it needs it) of this observation is my belief that many||most web aps are VERY poorly secured. So while I agree with Fletch's assessment of blame, I don't think that's the end of the chain of victims -- clueless users, like my Grandparent or yours, wanna-be-webmasters who haven't had the exposure to the school of hardknocks that some||many monks have endured (and profitted from) and so on... ie, the very folk to whom Joost 's phrase --- "good security measures..." --- is a complete mystery.

Anyone whose web application is compromised because they trusted the contents of the referrer header has only themselves to blame.

Haha. Well, I just wasn't thinking straight (for some reason I kept substituting "location" for "referer")

Actually, I can't really think of any good security measures that can be messed with by faking referer headers. The few times I've had to fake them myself was for automating really badly "secured" web apps. Usually all you'll mess up are website statistics - which are unreliable anyway.

"What should it profit a man, if he should win a flame war, yet lose his cool?"