I have a section of my web site that I only want reachable from another portion of my web site. I know that referer spoofing is trivially easy. But, if all requests from an incorrect referrer are met with 303 redirects to an index page, is there any way for the client to determine that the referrer is the criteria on which they are being denied, or even that there is anything for them to be denied from?
In other words, could this be sufficient protection from bots or individuals without a specific target in mind? I realize this qualifies as security through obscurity, but in this case I'm not expecting targeted attacks, and I don't see how you would discover it from outside.
If it makes any difference, the redirect is being sent by nginx.