Firefox and cgi.http_referer

[Muwa]

Weird behavior in Firefox:
to start -> I click from a [url]www.acmecompany.com[/url] site to my company's site
([url]www.mycompany.com/page.cfm[/url]).

First bizarre thing that happens: the link on [url]www.acmecompany.com[/url] to my site
is [url]www.mycompany.com/page.cfm[/url], but when you get there it resets itself to
[url]www.mycompany.com//page.cfm[/url]. Notice the two forward slashes. I can't find the
cause of this anywhere....it's really weird.

Next: I can't access the cgi.http_referer information unless I click back to
the company's site and then click on the link again! So, first time the
len(cgi.http_referer) = 0, click back button and then click link again (and now
I'm assuming because the session is established, because the problem goes away
for twenty minutes, which is the length the session is set to) and the
cgi.http_referer variables is there and populated with
'www.acmecompany.com/somepage.cfm'.

Anyone even heard of this with Firefox?

Thanx,
Muwa

[Mike Greider]

I personally haven't heard of this, but I haven't been looking for it either.
Just out of curiousity, are you relying on the referrer for anything important?
It's easily spoofed and some browsers, like opera, give you the option to never
pass the referrer.

[Muwa]

Yeah, lots of ways to spoof that. But, it's still a good way, given the alternatives. And, given the nature of information that is being protected, not really that dangerous to have it out there.

[Mike Greider]

Perhaps you can explain more what you are trying to do? I'd be happy to provide
some additional suggestions. Personally, I think it's best practice not to do
anything that relies on variables that are outside your control, or can be
easily modified. The referrer is one of those.

[Muwa]

the user passes an ID in their URL and I check the referering URL based on the
ID they pass. I store the allowed URLs in a database, that are associated with
that ID.

If I find the correct url passed in cgi.http_referer, then it works, if not, I
throw an error.

For some reason this site (and only this site) won't work. But, only their
site won't work in Firefox. It works fine in IE.

One thing I noticed was that they are linking to a site that is forwarded via
Verisign for us and the forward we had setup had a trailing forward slash (see
the first problem in the opening post), so when I removed the trailing forward
slash, that fixed problem #1. I hoped that would fix the second problem, but
it did not.

I'm still at a loss as to why the cgi.http_referer var is not there. All the
other CGI scoped variables are available....it's tres bizarre.

Thanx for any ideas/thoughts/help you may have,
Muwa