Referrer

[apple17]

Where can I find information on how the 'referrer' is set?

Specifically, I want to check the referrer to ensure that the page is being accessed from the proper site (also, I do different things if it came from outside the site versus if the user was already in the site and just coming back to the main page).

If a user comes in the 'normal' way (from 'page1.asp') it works fine. However, if the user is redirected from 'page2.asp' to 'page1.asp' to my page, the referrer appears to be blank! Not even a hint of a URL! Does this make sense? Is there any other way I can tell where the page is being called from?

 

[Abraxus]

One of the best sites I've found is here:

http://www.w3schools.com/asp/coll_servervariables.asp

That is the whole collection of the Request.Servervariables object, which includes a description of Request.Servervariables("HTTP_REFERER").

What I've found is that when I'm in a situation where I care about the referer I usually assign a session variable. An example would be that I had two main pages a user would be using the same service from, either "active" or "closed." Right on the active and closed pages respectively I would set session("referer") to the current URL. That way after a number of forms had been filled out and lots of pages used and data collected, I could redirect to the session("referer"), which was set to one of the two important pages that I needed to return the user to.

Hope this helps!

 

[Turkbear]

Hi,
Using HTTP_REFERER will show a blank for redirects:

Returns a string containing the URL of the page that referred the request to the current page using an <a> tag. If the page is redirected, HTTP_REFERER is empty

I use a bit of JavaScript to check for the referrer:

<SCRIPT LANGUAGE="JavaScript">
if (document.referrer != "[URL unfurl="true"]http://myserver/LBRREL/logon/my_logonform.asp"[/URL] 
{
 window.alert("Invalid Entry Point - Access Denied")
 location.href="[URL unfurl="true"]Http://myserver/LBRREL/logon/my_logonform.asp"[/URL]
)
 
</SCRIPT>

Probably better ways, but this seems to work ok..




To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[Sheco]

The value is not set by the server, it is set by the web browser. It is also not required by the HTTP spec so not all browser will set it under the same circumstances.

Unless you are developing for an Intranet where you can be sure that all users have the same version of the same browser, I wouldnt use it for anything more important than fancy homebrew usage logs.