How to know if a web request is made from particular another known website's link button

Question

I have two website

1) Main website: it has a link Help & Training that redirects user to another Help website.

2) Help website has no authentication rules thus anybody can visit the website directly.

Now I have a requirement to allow second website to be visited from first website's link, all the other request should be redirect to another page.

Offcourse querystring/parameter validation is not acceptable as that can be visible and constant

Is it possible, any suggestion is appreciated.

score 3 · Accepted Answer · answered May 02 '12 at 13:23

You can use http://msdn.microsoft.com/en-us/library/system.web.httprequest.urlreferrer.aspx which is just an ASP.NET wrapper around the HTTP referrer header. http://en.wikipedia.org/wiki/HTTP_referrer

This, of course, can be spoofed so don't rely on it for creating something super secure.

score 2 · Answer 2 · answered May 02 '12 at 13:20

2

what if you add a get parameter to the link's url in the first site and checks for it in the second site. That's of course a very simple solution and could be cheated pretty fast.

answered May 02 '12 at 13:20

Krasimir

13,306
3
40
55

I suggested the same, but they don't accept as if anybody know the parameter they can still access the second site. – Imran Rizvi May 02 '12 at 13:44

score 0 · Answer 3 · edited May 23 '17 at 11:56

0

from here:

You could use the UrlReferrer property of the request:

Request.UrlReferrer

This will read the Referer HTTP header from the request which may or may not be supplied by the client (user agent).

edited May 23 '17 at 11:56

Community

1
1

answered May 02 '12 at 13:27

Iman

459
4
19

score 0 · Answer 4 · answered May 02 '12 at 13:28

Hi you can use this block of code to identify from where the user came to your website

 If Not IsPostBack Then
            If Not Request.UrlReferrer.ToString() Is Nothing Then
                referrer = Request.UrlReferrer.ToString()
            End If
        End If

score 0 · Answer 5 · answered May 02 '12 at 14:22

if you want something that's not easily spoofable by average users...

site2 exposes a webservice which validates a "secret" parameter (could just be some long random string that only site1 and site2 know). this service returns a unique "token" that is only good for a small period of time. site1 appends this token to the querystring when directing the user to site2. site2 validates that the token is legit and still valid. once a token has been used, site2 no longer treats it as valid.

How to know if a web request is made from particular another known website's link button

5 Answers5