HTTP_REFERER issue

mobij

file.html

<SCRIPT LANGUAGE="JavaScript">
var newwindow;
function 1pops(url)
{
	newwindow=window.open(url,'name','height=393,width=349');
	if (window.focus) {newwindow.focus()}
}
</script>

<a href="javascript:1pops('../../viewfile.php?file=word.doc');" >Some link</a>

viewfile.php

<?

$dim = getenv("HTTP_REFERER");
echo "$dim";
switch ($_SERVER['HTTP_REFERER']) {
  case "http://www.yahoo.com":
echo "it works!";
    break;
  default:
  echo "please contact support at [email]a@a.org[/email]";
  exit;
    // And the rest...
}

?>

mobij

This code is use on a landing page from a new javascript window on my website.

FireFox & Netscape can pick up the HTTP_Referer but not IE.

Not sure why this is an issue with IE since HTTP_Referer is server side.

If I pass the page directly without using a new javascript window, then IE would be able to see HTTP_REFERER.

Any ideas?

Drakla

Lovely. Be nice to know WHAT trouble you're having, though.

mobij

😕

Drakla

When I posted you hadn't put in the 2nd bit with the explanation.

A browser doesn't have to pass on its referrer, so maybe your IE isn't doing that so the server field is empty.

mobij

Let me try and explain this better 🙂

All browsers work fine if I setup my script this way.

++CASE # 1++++++++++++++++++

file.html

<a href="viewfile.php">view file here</a>

viewfile.php

<?

$dim = getenv("HTTP_REFERER");
echo "$dim";
switch ($_SERVER['HTTP_REFERER']) {
  case "http://www.yahoo.com":
echo "it works!";
    break;
  default:
  echo "please contact support at [email]a@a.org[/email]";
  exit;
    // And the rest...
}

?>

++CASE # 2++++++++++++++++++

IE will not pass HTTP_REFERER if I use a javascript window. However, Netscape and Firefox works fine.

file.html

<SCRIPT LANGUAGE="JavaScript">
var newwindow;
function 1pops(url)
{
	newwindow=window.open(url,'name','height=393,width=349');
	if (window.focus) {newwindow.focus()}
}
</script>

<a href="java script:1pops('../../viewfile.php?file=word.doc');" >Some link</a>

viewfile.php

<?

$dim = getenv("HTTP_REFERER");
echo "$dim";
switch ($_SERVER['HTTP_REFERER']) {
  case "http://www.yahoo.com":
echo "it works!";
    break;
  default:
  echo "please contact support at [email]a@a.org[/email]";
  exit;
    // And the rest...
}

?>

Drakla

So an IE window spawned via javascript considers itself to be fresh as a daisy with no history to pass on as its referrer.

What is the aim of your project, it might be solved another way if you specify.

mobij

The ultimate goal would be a script that only allows certain files to be downloaded.

For example:

Users viewing this page: www.abc.com/go.html, would only have access to certain files.

Users viewing this page:
www.abc.com/123.html would not be able to see any files.

Hence using the HTTP_REFERER to check where users come from.

99.9 of this site is in static html :glare: . It's a huge site and I make do with what I have.

I appreciate your insight 🙂

bradgrafelman

Not sure why this is an issue with IE since HTTP_Referer is server side.

Wrong. It's send by the client's browser in HTTP Headers, though it is not required.

I would suggest you not use javascript pop-ups. Why not just have the link continue on to another page like a normal link? Is there a demand for a Javascript pop-up? I'd hope not, because Windows XP SP2 disables pop-ups by default, requiring the user to manually allow them.

For better scalability and reliability (due to the diverse platforms/browsers out there), I would get rid of the Javascripting and simply use a normal link in this case.

mobij

HTTP_Referer is driven by Server Side interaction.

$_SERVER['HTTP_REFERER']

The use of javascript windows IS mandatory for my application. I do not have the option of a second landing page to launch our application.

Browser compatibility is subject to all versions of IE, NN and FF. These are the 3 dominant browsers for our users.

Even though SP2 disables pop-ups by default, the browser will provide a option to display the pop-up window. If you click on an application, normal circumstance would to expect something to launch. Thus, this would be a cause and effect situation.

I appreciate your suggestions; however my question is still left unanswered. I need to understand why IE is the only browser that does not have ability to pass HTTP_REFERER from a window.open javascript.

bradgrafelman

I haven't a clue. You'll have to ask Mr. Gates on that one.

A possibly solution would be to pass the "referer" in the URL, i.e.

newwindow=window.open(url+'?referer='+window.location,'name','height=393,width=349');

If you already have a '?' in the url, you'd want to change that to an '&' in my example (or write some Javascript to check whether there's a question mark in the url passed yet or not).

On the "pop-up" script, you would use $_GET['referer'] instead of getenv("HTTP_REFERER").

sds

Ran into the same problem! But thought I could make one addendum.

When linking via

href="mypage.php" target="_blank"

The referer header is passed along as expected and you get your new window. The referer is only not passed when using JavaScript's open function from IE.

In other words this is a problem with IE's implementation of JavaScript.

Drakla

So set a cookie or use a session (you might have to change the cookie parameter away from zero) and dump your current methodology.