manipulate HTTP_REFERER

Bou

Hello

I have a website where visitors get a unique ID once they enter my site. The ID variable is passed through cookies. However, since people with cookies disabled may want to surf to my web site as well, I pass the variable on via the URL as well. No problem so far.

However, when someone, say person A, is surfing on my site and decides to click on an external link to site www.other-site.com (or suddenly decides to go to www.other-site.com via de location bar), this other site will see a visitor with HTTP_referer: http://www.my-site.nl/blabla.php?IDvar=IDpersonA
When this site uses a tool to monitor their visitors, such as nedstat, a link to my site will appear in the Nedstat register of www.other-site.com with the IDvar of person A. (in a lot of cases, the visitor monitoring is available not only for the site owner but for everybody)

This means that anybody can enter my web-site with the ID of person A.

How can I prevent such a thing happening? Is there a way to remove the ?IDvar=... bit from the referer so that it is not visible in the visitor monitor of www.other-site.com??

Thanks in advance for all your help

Boudewijn

suntra

When you link to an external site, you could create a page which will redirect to the external site.

Example :

Link : /directory/redirect.php3?site=http://www.external-site.com/

redirect.php3 :

<?
 Header("Location: " . $_GET["site"] . "\n");
?>

And DON'T pass the ID to that page...

Do you understand ??

Bou

Hey, that's a very good solution!

Is the PHP redirecting bit
<?

Header("Location: " . $_GET["site"] . "\n");

full-proof? I'm asking this because Java has a redirect method as well, but it doesn't work when people have Java disabled.

Thanks a lot

Bou

ps what does your signature mean?

Bou

Unfortunately, the solution does not work :-(

I made a page externallink.html with:
<a href="http://www.my-site.nl/redirect.php?site=http://www.other-site.com">[url]http://www.other-site.com[/url]</a>

And I made redirect.php with
<?
Header("Location: " . $_GET["site"] . "\n");
?>

When I look at the statistics of www.other-site.com, I see "externallink.html" appearing instead of redirect.php ...

Bou