Meta-Refresh Directives

Many browsers do not send referring page data on a meta-refresh. They treat the refresh as a typed in url. Because of this, the request will fail on the http-referer test. You can successfully meta-refresh into a non-protected area as long as none of the files making up the page is in a protected area.