1

Im wondering if I can detect whether some webpage was reached by a link (button, link, redirect, ...) or by typping in the URL bar.

Im using Clojure for web programming, and I wish I could block the access to some page when the request came from a "typed url".

Right now I am encoding the urls so the user can't have access to the "real" url.

Thanks in advance.

2 Answers 2

3

Short answer is no. Your aproach is correct.

And with a bit of skills one can also send arbitrary HTTP requests, GET or POST, modifying cookies, headers and the body of the request, so if this is about security, your approach to use encrypted data seems the only one possible to ensure that the URL is not tampered or manually typed.

The HTTP Referer header can be also faked, the same as a url parameter. There is no more security on using a http header or a url encoded parameter.

1
  • Yes, through http-header I could get the referer, but as you said, it can be faked also. But it is at least something else. I will try working with encrypted data, it is more secure. Thanks for your help Jun 28, 2016 at 21:50
3

Courtesy of Wikipedia:

The HTTP referer (originally a misspelling of referrer[1]) is an HTTP header field that identifies the address of the webpage (i.e. the URI or IRI) that linked to the resource being requested. By checking the referrer, the new webpage can see where the request originated.

I assume you can access the HTTP header fields. If the user were to type in the URL into the address bar, there would be no HTTP referer.

3
  • Thanks, I checked and I have the "referrer" url in my header. Jun 28, 2016 at 18:21
  • 1
    This header can be faked with ease and shouldn't be used for security purposes. Jun 29, 2016 at 10:19
  • @JarredHumphrey True, but that goes without saying for all HTTP fields (except maybe encrypted cookies)
    – micker
    Jun 29, 2016 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.