Using Request.Referrer

[Wayne Wengert]

I want to restrict access to a specific ASP.NET page base on the calling
URL. I am trying the code below to get the calling URL but I get an error
"Object reference not set to an instance of an object". What is the correct
way to accomplish this?

******************* Code Snippet **************************
Dim strReferrer As String = Request.UrlReferrer.ToString

******************************************************

 

[Joerg Jooss]

I want to restrict access to a specific ASP.NET page base on the calling
URL. I am trying the code below to get the calling URL but I get an error
"Object reference not set to an instance of an object". What is the
correct
way to accomplish this?

******************* Code Snippet **************************
Dim strReferrer As String = Request.UrlReferrer.ToString

******************************************************

Don't use Referrer for security features. This header can be changed by
proxies, is easily faked or not there at all if you invoke the URL directly.

Cheers,

 

[Wayne Wengert]

Joerg;

Thanks for the response. The planned use is not really a "security" issue -
we want to discourage bookmarking certain pages - we want users to enter the
site through the standard front end which includes announcements and such.
It is not a big deal if someone gets around the restriction but we figure
that this approach might discourage most casual users from bookmarking the
page.

Wayne

 

[Jos]

Joerg;

Thanks for the response. The planned use is not really a "security"
issue - we want to discourage bookmarking certain pages - we want
users to enter the site through the standard front end which includes
announcements and such. It is not a big deal if someone gets around
the restriction but we figure that this approach might discourage
most casual users from bookmarking the page.

Then use this test:
If (Request.UrlReferrer Is Nothing) Then
' it's a bookmark
End If

Keep in mind though, that generally users don't like it if you take away
functionality.
It's rarely justified to do that.

It's better to include a user control with your announcements
as a header or footer.

 

[Wayne Wengert]

Thanks for that suggestion Jos.

Wayne

Then use this test:
If (Request.UrlReferrer Is Nothing) Then
' it's a bookmark
End If

Keep in mind though, that generally users don't like it if you take away
functionality.
It's rarely justified to do that.

It's better to include a user control with your announcements
as a header or footer.