Miserable js is invalid for referer-based forgery.

During this period, I have been studying how to set a referer route in webbrowser to forge the route for traffic flushing. However, after studying the method for half a month, I finally ended up failing because of the current statistical code, actually, cnzz.com and google adsense bring their own statistics. Their statistics are based on js files, which leads to a false success, for more information, see the following article!
As we all know, the referer on the server can be forged. Both ASP, PHP, and other scripts can be forged with referer. Some download software can make referer forged, the webbrowser control can be used to easily forge the path. So how can we prevent these spoofed referers as website referers?
Here, we use Javascript as a powerful tool.
The above mentioned methods of spoofing referer are implemented through the server script, but they cannot fool the client. While JS is executed on the client, it does not handle the headers information on the server. Therefore, the document. referer method of js can be used to accurately determine the real path of the webpage.
Almost all third-party statistics use document. referer to determine the path. Why? It is based on the referer in js that cannot be forged. Even if a referer web page script is successfully forged on the server, it cannot be recorded in the third-party statistics because the third-party statistics use document. referer to identify the true path.
Therefore, in order to prevent false referer forgery Information, the Statistical Code must use document. referer of JavaScript to identify the forgery Information.
As far as we know, referer cannot be forged in js so far.
Someone asks, if the client closes JAVASCRIPT or even cookies, how do you determine this referer? In fact, the answer is also very simple, that is, JavaScript and asp/php scripts are implemented through the intermediate Bridge of cookies. js writes the referer into cookies, and asp/php reads the cookies, if the cookie cannot be read, it is not the origin site.