Javascript Referrer Check

[BC000]

I have a Javascript Referrer Check Script that I copied and pasted:

--------------------------------

<script>
<!--
/*Referrer Checker- By Website Abstraction
(

http://www.wsabstract.com)

Over 200+ free JavaScripts here!
*/

//specify valid referrals for script to accept
//if you wish an entire domain to be valid, enter that (ie: "wsabstract.com")
var validreferrals=new Array()
validreferrals[0]="

http://www.aimsurveyors.com.au/cgi-bin/member_menu.cgi"

var passed=0

for (r=0;r<validreferrals.length;r++){
if (document.referrer.indexOf(validreferrals[r])!=-1){
passed=1
break
}
}

if (passed<>0){
alert("Access to the page denied! Please come through Member Menu")
history.go(-1)
}

//-->
</script>
------------------------------

Well, it works OK, if someone tries to enter the page from another url and not member's menu, but if someone just copies and pastes the url staright into the address bar of the web browser, it still works. That shouldn't be the case. If someone pastes the url straight into the address bar, it should show the propmt and not the page.

Is anyone aware of a better referrer check script?

Thanks.

 

[feherke]

Hi

if someone just copies and pastes the url staright into the address bar of the web browser, it still works.

And also works if the visitor
[ul]
[li]opens the URL in new tab/window, where [tt]history[teal].[/teal]go[teal](-[/teal][purple]1[/purple][teal])[/teal][/tt] has nowhere to go back[/li]
[li]bookmarks the URL then visits it using the bookmark[/li]
[li]receives the URL in an e-mail and clicks it directly[/li]
[li]disables JavaScript[/li]
[li]disables sending the referrer[/li]
[li]sets a fake referrer[/li]
[li]comes from an address which contains any valid URL, like [ignore]

http://example.com/

[/ignore]?something=[red][ignore]

http://www.aimsurveyors.com.au/cgi-bin/member_menu.cgi

[/ignore][/red]&somethingelse=nothing[/li]
[/ul]

Is anyone aware of a better referrer check script?

I would first ask for a script that actually works. The one you posted will crash in Gecko, Presto, WebKit and KHTML, because no <> operator exists in JavaScript. And in case <> was used instead of [tt]!=[/tt], the logic is wrong. There should be equality check. ( Yepp, using boolean values for logical conditions, improves the readability. )

Personally I always suggest one thing : give up with the ideas to use the referrer to deny access.


Feherke.

http://free.rootshell.be/~feherke/

 

[djhill]

I agree with Feherke, who must have a web security background ;-)

I see "cgi" in the URL there, which in the old days meant standalone executables for each page, but I assume you're actually using a framework. Can you comment on which framework you're using, and on whether that framework provides a means of securing pages via configuration information?