Solved

ServerVariables("HTTP_REFERER") = null when using HTTP, but not on HTTPS

Posted on 2004-03-30
3
1,410 Views
Last Modified: 2011-04-25
This is by far the oddest bug I've ever encountered.

Our site is used with both HTTP and HTTPS (where HTTPS is for users who log in). This means that HTTP is used as the default except on certain pages that need to be secure (like the cart/checkout).  Our setup for purchasing works in a simple way; each page that actually adds/modifies a product contains a Response.Redirect(url) at the end so the page is never seen by the browser.  On each of these pages however, we trap for outside requests/POSTs for security reasons.


now the fun part.

When using HTTP, the Request.ServerVariables("HTTP_REFERER") is null.  the HTTP_REFERER object is also not part of ALL_HTTP either.  The basic effect is that anyone not logged in now cannot order anything because the modifier page does not detect that the request is coming from a friendly page.

Here is the ALL_HTTP when using HTTP:
HTTP_CONNECTION:Keep-Alive
HTTP_ACCEPT:image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash, */*
HTTP_ACCEPT_ENCODING:gzip, deflate
HTTP_ACCEPT_LANGUAGE:en-us
HTTP_COOKIE:ASPSESSIONIDCQATSTTA=GIOBCOCAPFPLBFJHPJLIFCJK; SID=985856788702504439920922680162
HTTP_HOST:www.baka.ca
HTTP_USER_AGENT:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705)


Switch to HTTPS, and the Request.ServerVariables("HTTP_REFERER") returns a proper value.  So anyone who logs in CAN order products because the request page is properly detected.

Here is the ALL_HTTP when using HTTPS:
HTTP_CONNECTION:Keep-Alive
HTTP_ACCEPT:image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash, */*
HTTP_ACCEPT_ENCODING:gzip, deflate
HTTP_ACCEPT_LANGUAGE:en-us
HTTP_COOKIE:ASPSESSIONIDCQATSTTA=GIOBCOCAPFPLBFJHPJLIFCJK; SID=985856788702504439920922680162
HTTP_HOST:www.baka.ca
HTTP_REFERER:http://www.baka.ca/test/referer.asp?3%2F30%2F2004+12%3A36%3A38+PM
HTTP_USER_AGENT:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705)


You can view my test page at http://www.baka.ca/test/referer.asp
The page contains 2 links at the bottom that switch between HTTP and HTTPS.  The HTTP_REFERER is bold and in red so you can't miss it (done through code). I also removed a the PATH_TRANSLATED and APPL_PHYSICAL_PATH intentionally (through code).

The question is, What is causing this error/problem and/or How do I solve it?
0
Comment
Question by:zeroreality
3 Comments
 
LVL 37

Accepted Solution

by:
meverest earned 500 total points
ID: 10720487
Hi.

the browser is what provides that variable, not the server.  it is a browser issue you have coem up against.

on that note, i suggest to you that you should NEVER use a browser supplied data to run your web applications because as a developer, you normally never have control over what the browser does or what data it supplies (or doesn't supply)

there's also a security concern that if you use the datya supplied by the client, then there's no ay to tell whether it is accurate, or properly constructed, or even that it is legitimate and not faked!

i suggest that you try another way to get around that referrer requirement - either by a session variable or maybe url semaphore or form field.  the latter two (of course) also have similar security concerns.

(by the way, the http_referer worked fine for me on both http and https at your demo page)

good luck,

Mike.


0
 
LVL 2

Author Comment

by:zeroreality
ID: 10720878
i didn't even think of that.
ive tested it from home now and you're right... no issues.  so it has to be some kind of issue from our machines at work.

thanx for the advice, ill take it to heart  :)
0
 
LVL 4

Expert Comment

by:ajaykerala
ID: 35463573
can i know if you managed to get http_refferal working from a https domain ?
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
"Realm" or "Domain" prompt 11 45
Http hosting redirect issue 2 38
DLL in ASP.NET 20 56
Windows 10 IIS and Windows Authentication to SQL 21 53
If you don't have the right permissions set for your WordPress location in IIS, you won't be able to perform automatic updates. Here's how to fix the problem.
If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
A company’s greatest vulnerability is their email. CEO fraud, ransomware and spear phishing attacks are the no1 threat to a company’s security. Cybercrime is responsible for the largest loss of money to companies today with losses projected to r…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now