Is there any alternative to HTTP-REFERER?

Discussion in 'PHP' started by arshnet, Jun 27, 2006.

0
  1. #1
    I am trying to restrict direct access to my pages. I want to force the users to come through a specific URL.

    What would be the best way to implement this using PHP?

    New to PHP here.. anyone?
     
    arshnet, Jun 27, 2006 IP
  2. digitalpoint

    digitalpoint Overlord of no one Staff

    Messages:
    38,334
    Likes Received:
    2,613
    Best Answers:
    462
    Trophy Points:
    710
    Digital Goods:
    29
    #2
    You can use the $_SERVER['HTTP_REFERER'] variable to do check it.
     
    digitalpoint, Jun 28, 2006 IP
  3. ipheo.com

    ipheo.com Peon

    Messages:
    21
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    This superglobal might not always be available though, or the URL might be hidden or modified. If you want them to come through a specific URL, perhaps you could redirect them, or use cookies/sessions to ensure they visited the page you want them to visit first.
     
    ipheo.com, Jun 28, 2006 IP
  4. arshnet

    arshnet Peon

    Messages:
    2
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Thanks for your reply.

    I have two apache web servers running on two different boxes.

    The main website is on one server using perl and some of the pages are on the other server using php.

    I just want to make sure that the users access the pages from the main website and do not go directly to specific pages.

    HTTP REFERER is not reliable and can be facked.

    Can you guys suggest a way to do this without using the referer?
     
    arshnet, Jun 28, 2006 IP
  5. amnezia

    amnezia Peon

    Messages:
    990
    Likes Received:
    31
    Best Answers:
    0
    Trophy Points:
    0
    #5
    the only other way to do it would be to track users movements using sessions
     
    amnezia, Jun 28, 2006 IP
  6. Paul_F

    Paul_F Guest

    Messages:
    18
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #6
    Does it have to be PHP? Can you not use .htaccess?
     
    Paul_F, Jun 30, 2006 IP
  7. JEET

    JEET Notable Member

    Messages:
    3,832
    Likes Received:
    502
    Best Answers:
    19
    Trophy Points:
    265
    #7
    Put a cookie on the page you want visitors to see first. Then check on the page you want to block. If cookie exists, show the page else display error message.
    But again not very reliable as many people turn off cookies...

    Another thing that came in mind, Set a variable. Let people click a button instead of using a link. The button submits a hidden form field. Check the value on page you want to block. If value found, load page else display error.
    Not sure how reliable this would be...
    bye
     
    JEET, Jun 30, 2006 IP
  8. scottj

    scottj Peon

    Messages:
    168
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #8
    The fact remains that the Referer: HTTP header is the only mechanism that HTTP provides for tracking which page a user came from. Even this can be faked, though. There's really not a 100% effective way to force someone to visit another page before going to your page.
     
    scottj, Jul 1, 2006 IP