POST method and HTTP-REFER

[Jay Janarthanan]

We have a application which allows other authorized sites to send users to
our site...when the user is sent to us, user info is sent to us as a hidden
Form variable and we use the HTTP-REFER variable to make sure the user is
coming from an approved site. Now I understand the user of HTTP-REFER is not
a good idea, is there any other ways to validate where a user is coming
from.

Jay

[Fredrik Normén www.NSQUARED2.net]

You can use the REMOTE_ADDR server variable to get the
users IP adress and use it instead of HTTP_REFER.
But the only way to get the page a user came from is with
the HTTP_REFER..

/Fredrik Normén NSQUARED2
[url]http://www.nsquared2.net[/url]

>-----Original Message-----
>We have a application which allows other authorized sites

to send users to

>our site...when the user is sent to us, user info is sent

to us as a hidden

>Form variable and we use the HTTP-REFER variable to make

sure the user is

>coming from an approved site. Now I understand the user

of HTTP-REFER is not

>a good idea, is there any other ways to validate where a

user is coming

>from.
>
>Jay
>
>
>.
>

[Jay Janarthanan]

Thanks...but we need to know where the user came from. HTTP_REFER is good,
but some time older browsers don't support it. We found the support around
96%., but for me the biggest worry is the security and since HTTP_REFER is
at Layer7, it can be spoofed a lot easily.

Jay



"Fredrik Normén www.NSQUARED2.net" <fredrik@nospam.com> wrote in message
news:0e5d01c38b16$6fda8880$a401280a@phx.gbl...
You can use the REMOTE_ADDR server variable to get the
users IP adress and use it instead of HTTP_REFER.
But the only way to get the page a user came from is with
the HTTP_REFER..

/Fredrik Normén NSQUARED2
[url]http://www.nsquared2.net[/url]

>-----Original Message-----
>We have a application which allows other authorized sites

to send users to

>our site...when the user is sent to us, user info is sent

to us as a hidden

>Form variable and we use the HTTP-REFER variable to make

sure the user is

>coming from an approved site. Now I understand the user

of HTTP-REFER is not

>a good idea, is there any other ways to validate where a

user is coming

>from.
>
>Jay
>
>
>.
>