0

I have a php page A which redirects to page B. I have a shortlink on page A. I want access to be denied to A unless the user accesses from the shortlink.

The problem is that the shortlink creation site is blocking the USER WEB AGENT HTTP_REFERER. So I can't tell if the user comes from the shortlink on page A.

So the user can just write the url of page A to be redirected to page B without going through the shortlink.

Is there a way or idea to avoid redirecting the user to B if he has access to A through the url or other than the shortlink ?

8
  • 1
    What is the purpose of blocking users in this case? Jan 19, 2021 at 16:46
  • I couldn't use the REFERER on page B, so I created a new page A and so to access B you have to come from A, except that A is accessible from the url. The goal is that in B, I have a key generator that starts automatically if we access the page, and I want the user to generate a key only by accessing through the shortlink which is the shortcut link of the page A (page A gonna make a redirection to B and generate a key)
    – Meds
    Jan 19, 2021 at 17:00
  • What is this key used for? It sounds like you might need a better security system than what you were proposing. Jan 19, 2021 at 17:50
  • I do not know the exact use of this key but I would like to know the affordable solutions for this kind of logic
    – Meds
    Jan 19, 2021 at 18:21
  • "I have a php page A which redirects to page B. I have a shortlink on page A." - So, the "shortlink" redirects to "page A"? Why not redirect directly to "page B"? Is "page A" performing some other action?
    – MrWhite
    Jan 19, 2021 at 18:35

1 Answer 1

4

The problem is that the shortlink creation site is blocking the USER WEB AGENT HTTP_REFERER. So I can't tell if the user comes from the shortlink on page A.

The "shortlink creation site" probably isn't blocking anything. When a URL is typed directly into the browser there is no Referer. A 3xx redirection does not create a Referer.

It is not possible for "Page B" to determine whether the request was redirected from "page A" or from the shortlink, if the user manually typed the URL, since there is no Referer to begin with. The only way to determine the source of the redirect (at "B") is if something was appended to the redirected URL that "page B" can check for. eg. A benign query string: ?redirect=shortlink.

See also: Double redirect - referrer in headers

Is there a way or idea to avoid redirecting the user to B if he has access to A through the url or other than the shortlink ?

Check the URL being requested?

6
  • in fact, I agree that maybe the website of shortened links does not block the http_referer, but by clicking on the button to get to my page, there is surely a redirect which makes my page the http_referer is empty (not isset), how could they do that? Maybe by modifying the http_referer. If I add a query string in the url, well the user can always add this string in the url
    – Meds
    Jan 19, 2021 at 19:37
  • 1
    @Meds,instead of querystring that a user can deciper, what about using your own hash/algorithm that uses a timestamp. Your secondary server can test if the provided querystring matches a timestamp that is less than 30 seconds old.
    – Trebor
    Jan 19, 2021 at 23:01
  • 1
    "clicking on the button to get to my page" - where is this "button", it is standard HTML "link"? Check the network traffic in the browser - is the Referer HTTP request header set by the browser on the initial request? What is the nature of the redirect chain? The passing of the Referer can be controlled by the source website (that contains the link) by setting a Referrer-Poilcy. The redirect service could also destroy the Referer by going via an intermediary link that sets a Referrer-Policy.
    – MrWhite
    Jan 20, 2021 at 0:17
  • 1
    However, "shortlink/redirect" creation sites generally do not do this. If they have the option to remove the Referer then this would be an additional service. In general, it is in everyone's interests that the original Referer remains intact. All the main shortlink services that I'm aware of preserve the HTTP Referer.
    – MrWhite
    Jan 20, 2021 at 0:19
  • The shortlinker is linkvertise. "clicking on the button to get to my page" - there is a button but i don't see any action or form tag, or a href link. The link is linkvertise.com/200619/Testing2?o=sharing -- Can u tell me more about the horodatage logic please ?
    – Meds
    Jan 20, 2021 at 2:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.