POST method and HTTP-REFER

[Jay Janarthanan]

We have a application which allows other authorized sites to send users to
our site...when the user is sent to us, user info is sent to us as a hidden
Form variable and we use the HTTP-REFER variable to make sure the user is
coming from an approved site. Now I understand the user of HTTP-REFER is not
a good idea, is there any other ways to validate where a user is coming
from.

Jay

 

[Jay Janarthanan]

Thanks...but we need to know where the user came from. HTTP_REFER is good,
but some time older browsers don't support it. We found the support around
96%., but for me the biggest worry is the security and since HTTP_REFER is
at Layer7, it can be spoofed a lot easily.

Jay



You can use the REMOTE_ADDR server variable to get the
users IP adress and use it instead of HTTP_REFER.
But the only way to get the page a user came from is with
the HTTP_REFER..

/Fredrik Normén NSQUARED2
http://www.nsquared2.net