Google API Key and Domain Check

Question

Hello, did anyone know how the domain check for the Google API Key works? Did Google only check for the URL in the Locationbar of the browser or is it more complex?

I want to use such feature in my own application but any of my solutions is easy to bypass.

Answer 1

Just send the javascript:location.href, and compare it against the HTTP REFERER.