Request.ServerVariables and Firewall 1

[seaport]

I read several threads in this forum about using Request.ServerVariables. Good tips. However, I had experiences that some information in the Request object was blocked by the firewall.

One of my web application uses “Referrer” in the Request.ServerVariables. This worked for most clients, but had error with one client since this "referrer" returns nothing. This client admited that his company did have a firewall.

It is my guess that the firewall blocks some information in the request object. Am I right? If I am right, how much does the firewall affect Request object?

Seaport

 

[Sheco]

It might be the firewall or it might be some other privacy measures either in the browser, on the computer, or on the network.

The ServerVariables collection is created from the HTTP Request sent by the browser.

Make a little page like this:

<%
For Each MyThing In Request.ServerVariables
  Response.Write MyThing & " = " & Request.ServerVariables(MyThing) & "<BR>" & vbCrLF
Next
%>

Now load that page and you'll see all of the values in the ServerVariables collection. One of them will be something like ALL_RAW or something about "raw" ... I forget. Anyway, if you compare that to the HTTP Request you'll see it is basically straight off the request.

 

[seaport]

Sheco,

Basically, I'd like to know whether "request.ServerVariables" is a reliable solution in ASP (my first question). Your code works fine on my computer and I am pretty sure it works with most of my clients.

This is similar to the "cookie" problem. Some people disabled cookies in their browsers. However, with some simple code, an ASP page can detect whether the browser disables the cookie and then shows a warning in the browser. Here is my second question, is it common practice adding some code (in an ASP page) to test whether "request.ServerVariables" are blocked, just like the way testing whether cookies are accepted?

Seaport

 

[Sheco]

It is rare that everything that *could* be in in the HTTP Request is ever *actually* there.

Let me try to give an example: There is a header field called LOGON_USER. Under normal circumstances this will not be part of the request... so it will appear empty in the ServerVariables collection. But if the browser sends a request and the server response is 401 Access Denied then most browsers will automatically resend the request with a value for LOGON_USER. If the browser doesn't already know the value then it will prompt the user. The Internet Explorer browser will continue to send LOGON_USER as part of all future requests to the same web server... at least until you restart the browser.


So I guess the short answer is that you can only count on fields being in the request if they are needed to create a meaningful response. (ie: page requested and host ip address)

 

[seaport]

Sheco,

Thanks.

Seaport