lib/DefaultClient.php
private function assignRedirectRefererHeader(Request $request, string $refererUri, string $newUri): Request {
        $refererIsEncrypted = (\stripos($refererUri, 'https') === 0);
        $destinationIsEncrypted = (\stripos($newUri, 'https') === 0);

        if (!$refererIsEncrypted || $destinationIsEncrypted) {
            return $request->withHeader('Referer', $refererUri);
        }

        return $request->withoutHeader('Referer');
    }
private function assignRedirectRefererHeader(Request $request, string $refererUri, string $newUri): Request {
        $refererIsEncrypted = (\stripos($refererUri, 'https') === 0);
        $destinationIsEncrypted = (\stripos($newUri, 'https') === 0);

        if (!$refererIsEncrypted || $destinationIsEncrypted) {
            return $request->withHeader('Referer', $refererUri);
        }

        return $request->withoutHeader('Referer');
    }
private function assignRedirectRefererHeader ( Request $ request , string $ refererUri , string $ newUri ) : Request { $ refererIsEncrypted = ( \ stripos ( $ refererUri , 'https' ) === 0 ) ; $ destinationIsEncrypted = ( \ stripos ( $ newUri , 'https' ) === 0 ) ; if ( ! $ refererIsEncrypted || $ destinationIsEncrypted ) { return $ request -> withHeader ( 'Referer' , $ refererUri ) ; } return $ request -> withoutHeader ( 'Referer' ) ; }
Clients must not add a Referer header when leaving an unencrypted resource and redirecting to an encrypted
resource.

@param Request $request
@param string  $refererUri
@param string  $newUri

@return Request

@link http://www.w3.org/Protocols/rfc2616/rfc2616-sec15.html#sec15.1.3
Clients must not add a Referer header when leaving an unencrypted resource and redirecting to an encrypted resource .