1

I've got a theoretical problem I'd like to solve. Imagine I want to reference an external resource from within an HTML document. However, I want the behaviour when following the link to vary depending on the domain of the referring page (the page with the link).

e.g.

A page hosted at http://somedummydomain.com/mypage.html contains a link to a resource http://someotherdummydomain.com/mydoc.pdf?key=123456789.

When a user clicks on the link to mydoc.pdf, I would only like mydoc.pdf to be returned (200 OK) if the referrer is somedummydomain.com - if it's any other domain then return 401 NOT AUTHORIZED. The significance of the key in the query params is that the application serving mydoc.pdf will, internally, have associated that key with the somedummydomain.com domain, thus stipulating that the resource can only be accessed via that domain.

Obviously I could check the referrer, but it's trivial to spoof the referrer in the HTTP headers so, were I genuinely trying to lock something down, the referrer header is not going to be satisfactory.

I'm kind of assuming that JavaScript would have to come into play in some way? I'm judging that based on things like the Google Analytics JS code that will only accept events occurring on a page hosted at a pre-registered domain.

Does anyone know how this type of behaviour could be achieved?

DrewEaster
  • 3,316
  • 3
  • 35
  • 39
  • 2
    JavaScript won't help. The secure way to do this is to have the other sites request your resource via a proxy on their side, such that they must pass you a secure token as part of the request. The other site can't do that purely from the client because everything in the client is visible to the user at the browser. – Pointy Aug 15 '13 at 18:31
  • Thanks for your answer. I was hoping this wasn't the only solution! I am wondering, though, how does Google Analytics prevent people spamming other people's analytics data? – DrewEaster Aug 15 '13 at 19:00
  • [See this old question on that very topic.](http://stackoverflow.com/questions/2418609/how-does-google-analytics-prevent-traffic-spoofing) – Pointy Aug 15 '13 at 19:42

0 Answers0