problems with Request.UrlReferrer

Discussion in 'ASP .Net' started by Harley, Aug 9, 2003.

  1. Harley

    Harley Guest

    i have found a problem when using Request.UrlReferrer. if i call the page
    using a javascript function, the referrer is null...
    i need to call a page and open it on a specific browser size, with no
    toolbar, menu, etc. and also need to check that the call comes from a
    specific page.
    how to make request.UrlReferrer work?
     
    Harley, Aug 9, 2003
    #1
    1. Advertising

  2. "Harley" <harleyobrien%40hotmail.com> wrote in message
    news:...
    > i have found a problem when using Request.UrlReferrer. if i call the page
    > using a javascript function, the referrer is null...
    > i need to call a page and open it on a specific browser size, with no
    > toolbar, menu, etc. and also need to check that the call comes from a
    > specific page.
    > how to make request.UrlReferrer work?


    What makes you think it's broken?

    If you want the page to know which page it came from, even when invoked by
    your JavaScript function, then send the URL in a query string.
    --
    John Saunders
    Internet Engineer
     
    John Saunders, Aug 9, 2003
    #2
    1. Advertising

  3. Harley

    Harley Guest

    but theres an html header that automatically gives you that... the
    Request.Referrer function read the header and exposes its value...
    in my case, i need to know the url of the referrer because the system will
    only allow calls from specific URLs. if you pass it as a parameter manually,
    the security is useless.
    everything work ok using standard <A HREF> but a call using javascripts
    windows.open gives a blank referrer.


    "John Saunders" <> wrote in message
    news:%...
    > "Harley" <harleyobrien%40hotmail.com> wrote in message
    > news:...
    > > i have found a problem when using Request.UrlReferrer. if i call the

    page
    > > using a javascript function, the referrer is null...
    > > i need to call a page and open it on a specific browser size, with no
    > > toolbar, menu, etc. and also need to check that the call comes from a
    > > specific page.
    > > how to make request.UrlReferrer work?

    >
    > What makes you think it's broken?
    >
    > If you want the page to know which page it came from, even when invoked by
    > your JavaScript function, then send the URL in a query string.
    > --
    > John Saunders
    > Internet Engineer
    >
    >
    >
     
    Harley, Aug 9, 2003
    #3
  4. "Harley" <harleyobrien%40hotmail.com> wrote in message
    news:...
    > but theres an html header that automatically gives you that...


    Yes, but are you sure that this header was supplied? Perhaps it wasn't.

    > the
    > Request.Referrer function read the header and exposes its value...
    > in my case, i need to know the url of the referrer because the system will
    > only allow calls from specific URLs. if you pass it as a parameter

    manually,
    > the security is useless.


    The security is useless anyway! The header comes from the client as well.
    Surely if the client can spoof the querystring, then the client can spoof
    the Referrer header.

    You should find another security method.

    --
    John Saunders
    Internet Engineer
     
    John Saunders, Aug 9, 2003
    #4
  5. Harley

    Harley Guest

    sure, youre right the client can spoof with the header... the check is not
    supposed to provide a tight security, but an additional annoyance to
    unauthorized calls.
    i though that window.open ('www.server.com/page.htm') would create a regular
    normal http header, including the referrer. am i wrong?

    "John Saunders" <> wrote in message
    news:...
    > "Harley" <harleyobrien%40hotmail.com> wrote in message
    > news:...
    > > but theres an html header that automatically gives you that...

    >
    > Yes, but are you sure that this header was supplied? Perhaps it wasn't.
    >
    > > the
    > > Request.Referrer function read the header and exposes its value...
    > > in my case, i need to know the url of the referrer because the system

    will
    > > only allow calls from specific URLs. if you pass it as a parameter

    > manually,
    > > the security is useless.

    >
    > The security is useless anyway! The header comes from the client as well.
    > Surely if the client can spoof the querystring, then the client can spoof
    > the Referrer header.
    >
    > You should find another security method.
    >
    > --
    > John Saunders
    > Internet Engineer
    >
    >
    >
     
    Harley, Aug 10, 2003
    #5
  6. "Harley" <harleyobrien%40hotmail.com> wrote in message
    news:...
    > sure, youre right the client can spoof with the header... the check is not
    > supposed to provide a tight security, but an additional annoyance to
    > unauthorized calls.
    > i though that window.open ('www.server.com/page.htm') would create a

    regular
    > normal http header, including the referrer. am i wrong?


    If you look at the header, I believe you'll find that you're wrong.
    --
    John Saunders
    Internet Engineer
     
    John Saunders, Aug 10, 2003
    #6
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Hector Bejarano

    Request.UrlReferrer is nothing

    Hector Bejarano, Jul 8, 2003, in forum: ASP .Net
    Replies:
    0
    Views:
    843
    Hector Bejarano
    Jul 8, 2003
  2. Guest

    Usage of "Request.UrlReferrer"

    Guest, Dec 25, 2003, in forum: ASP .Net
    Replies:
    1
    Views:
    11,115
    Hermit Dave
    Dec 25, 2003
  3. Ivan Demkovitch

    Request.UrlReferrer is NULL ???

    Ivan Demkovitch, Jan 30, 2004, in forum: ASP .Net
    Replies:
    7
    Views:
    5,474
    Kevin Spencer
    Jan 30, 2004
  4. Oney
    Replies:
    3
    Views:
    4,158
  5. -=franz=-

    Request.UrlReferrer doesn't work

    -=franz=-, Sep 9, 2004, in forum: ASP .Net
    Replies:
    1
    Views:
    1,275
    Joerg Jooss
    Sep 9, 2004
Loading...

Share This Page