Site Authorization

[Maugwa]

I am having an issue with a site, I am able to get to the homepage of the site and I can access any link on the page that it directs me to, the problem I have is when I try to login with my creditials, it gets rejected, yet if I access the site from outside my work environment I can log in just fine. I have talked with the tech guys at the site and we are both at a loss as to what could be causing this. They just recently upgraded their payment security to Verisign and that's the only difference on their side and I have not changed anything in the environment here at my work location (firewall, dns, etc.). This was working properly 2 weeks ago.

I am looking to the professionals on this site for help in leading me in the correct direction to try to resolve this.

Thank you in advance,
Chad Kent

 

[Maugwa]

Also should probably include:
When I hit enter or select the go button I get a pop up box that states "No more shortcut or bookmark!!! Please use this page to login." and it directs me back to the homepage of the site.

 

[feherke]

Hi

Now it looks like they check the Referer HTTP header. That is what typically miss when a link is clicked from bookmarks.

That could be a browser setting, or firewall software tries to protect this way your privacy.

Of course, those "tech guys" know this better, but seeing their tech skill, would be better to check yourself.

1) See what your browser send
Install ( one of ) the following extensions/tools :
- Mozilla - LiveHTTPHeaders
- Explorer - ieHTTPHeaders
Make a request by clicking alink in a page and see the Referer value. Should be the URL of the page where you clicked the link.

2) See what leaves your machine
Click the below link and see what is the Referer value. Should be this Tek-Tips page's URL.

http://pgl.yoyo.org/http/browser-headers.php

Feherke.

http://rootshell.be/~feherke/

 

[Maugwa]

Okay, I tried what you said. For starters the link to the site was typed in to the address bar of IE6. I am not using a shortcut or favorite to access this site for these tests. I also deleted any cookie that the site may have left previously. For #2, I clicked on your link and the Referer value is correct (Tek-Tips page's URL). I show my header as being "inbound1.'my domain'.com", 'my domain' = my company domain name.

Any thing else I can try? I am behind a Watchguard Firebox and I can't find anything that pertains to header info in the policy settings.

 

[Maugwa]

Okay, I went into the firewall and changed some settings for HTTP. Got it working again, I hate when a site changes something and they don't notify their customers.