You are right. I used the referer in a "crude" way to determine if my session id is directly called or passed from a script. I was avoiding the possibility of session hijacking or replaying where one simply replay a session_id from the browser history and there he goes... doing stuffs he's not supposed to do.

Though my session id's are set to expire after "n" minutes, is there another sanity check besides using a "trivial" referrer?

To avoid replay attacks, use my "one click" processing technique. That'll also verify that it was a fresh form submission, and not forged from somewhere else.

-- Randal L. Schwartz, Perl hacker
Be sure to read my standard disclaimer if this is a reply.

Thanks! It's an excellent article.