Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > ASP .Net > ASP General > HTTP_REFERER question

Reply
Thread Tools

HTTP_REFERER question

 
 
M Smith
Guest
Posts: n/a
 
      03-22-2005
On our web site we allow our members access to features hosted by another
web site. The way the other web site authenticates users is to check the
value of the HTTP_REFERER. If it comes from our Login.asp page it lets them
in. When our users login to go to the other site, they login on our site's
Login.asp page. When they click submit, our LoginCheck.asp page validates
them and does a response.redirect to the other site. In most cases the
other site sees the HTTP_REFERER as Login.asp (I guess because the
LoginCheck.asp is doing a redirect and HTTP_REFERER doesn't work with
redirects). But in some case the other site is seeing nothing in the
HTTP_REFERER. My question is why would there not be a value in the
HTTP_REFERER object? If anyone can help I would appeciate it.


 
Reply With Quote
 
 
 
 
Thomas
Guest
Posts: n/a
 
      03-22-2005
there are clients (webbrowsers) that do not sent HTTP_REFERER. some clients
even allow you to change the referer value. doing an authentication based on
http referer ist about the weakest security you can have. basically you
could as well just put the link on your page without any login

- thomas


"M Smith" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On our web site we allow our members access to features hosted by another
> web site. The way the other web site authenticates users is to check the
> value of the HTTP_REFERER. If it comes from our Login.asp page it lets
> them
> in. When our users login to go to the other site, they login on our
> site's
> Login.asp page. When they click submit, our LoginCheck.asp page validates
> them and does a response.redirect to the other site. In most cases the
> other site sees the HTTP_REFERER as Login.asp (I guess because the
> LoginCheck.asp is doing a redirect and HTTP_REFERER doesn't work with
> redirects). But in some case the other site is seeing nothing in the
> HTTP_REFERER. My question is why would there not be a value in the
> HTTP_REFERER object? If anyone can help I would appeciate it.
>
>



 
Reply With Quote
 
 
 
 
Aaron [SQL Server MVP]
Guest
Posts: n/a
 
      03-22-2005
> redirects). But in some case the other site is seeing nothing in the
> HTTP_REFERER. My question is why would there not be a value in the
> HTTP_REFERER object?


Because it is totally up to the browser to send it or not.
http://www.aspfaq.com/2169


 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Getting HTTP_REFERER value John ASP .Net 2 10-08-2004 07:08 AM
Hit redirection & HTTP_REFERER Troy ASP .Net 1 06-26-2004 03:56 PM
Request.ServerVariables ("HTTP_REFERER") using https =?Utf-8?B?cHBhdGVs?= ASP .Net 1 03-03-2004 02:25 AM
HTTP_REFERER blank SStory ASP .Net 1 02-28-2004 07:58 AM
Webblocking software and using Request.ServerVariables("HTTP_REFERER") Elliot M. Rodriguez ASP .Net 1 02-12-2004 05:24 PM



Advertisments