I'm interested if someone can tell me if this idea will succesfully stop referer spoofing

As we know it's not hard

telnet
GET etc HTTP/blah
referer url etc
Thanks for coming!

But what if your page 'A' accepts only from refereres from example.com, But has no hidden info. But it does set a session variable, like

$_SESSION['showcontent'] = 'yes';

Then on page 'A' you have a link to your content page, page 'B' with hidden protected content (Forgetting logged in users etc etc I know that's the best way, but looking at an easy work around)

Now page 'B' only shows protected content after checking:-

if ($_SESSION['showcontent'] == 'yes'){

//show content

}

Would this be a reasonable work around, as I don't think you can pass a session across multiple telnet calls?

I'm not an expert on spoofing referers but have a situation where I would like to do something like this

So I am interested if spoofing is still possible to get content from page 'B', considering the above.

Thanks
eltreno