How to avoid user to open popup directly in the browser?

Question

On the click of the button, I am calling a javascript function which just opens a new window using following code.

window.open("mypopup_page.php", "_blank", "height=400, width=550, status=yes, toolbar=no, menubar=no, location=no, addressbar=no, top=200, left=300");

My problem is, even I have written location = no in window.open, user can see the url of the popup which he can copy paste into the addressbar of browser to open the popup directly. I don't want user to open the popup from the browser.

I am using .htaccess for redirection. For example to handle error 404, I have following code there:

ErrorDocument 404 /404.php

I want that, when the url contains mypopup_page.php file, .htaccess should redirect it to index.php so that user never be able to open it in the browser but only throught the popup.

Is there any way to do so through .htaccess file or is there any easier way to achieve my task?

Probably naming your window and sending a variable to the new window and checking if a variable has been sent from the parent window might be your best bet. The way you were thinking it would redirect to index.php no matter the way the page was opened. Something like [this](http://stackoverflow.com/a/87737/1700963) might help you. — Class, Apr 19 '14 at 03:13

kennypu · Accepted Answer · 2014-04-19T03:28:22.380

2

the simplest way is to use PHP and check $_SERVER['HTTP_REFERER']. If the referrer is not an address you want them to be coming from, eg, directly linking from browser, you can redirect them else where, or do whatever you want.

EXAMPLE: mypopup_page.php

<?php
$target_url = "http://" . $_SERVER['SERVER_NAME']; //this returns 'myexample.com'

//comparing the two variables. I'm using strpos here, but you can compare it in any way you want.
if(strpos($_SERVER['HTTP_REFERER'], $target_url) !== FALSE) {
  //all is good
} else {
  header("Location: http://google.com"); //redirecting here, but it can be anything
}

edited Apr 19 '14 at 03:28

answered Apr 19 '14 at 03:14

kennypu

5,950
2
22
28

Can you elaborate your answer more with a simple example. What should be the first line in my mypopup_page.php to check whether this file has been opened from popup (normal way) or directly from the browser? – Apr 19 '14 at 03:19

score 0 · Answer 2 · answered Apr 19 '14 at 03:42

Parent page:

var varToSend = 'someuniquevalue';
var win = window.open("mypopup_page.php", "_blank", "height=400, width=550, status=yes, toolbar=no, menubar=no, location=no, addressbar=no, top=200, left=300");
win.varToSend = varToSend;
//or you might need to use setTimeout?
window.setTimeout(function(){win.varToSend = varToSend;}, 2000);//2000 = 2 seconds or whatever it might take for the page to finish loading.

mypopup_page.php

window.setTimeout(function(){
    if(typeof varToSend !== 'undefined' && varToSend === 'someuniquevalue'){
        //we are ok
    }else{
        window.close();//may work
        //or
        window.location.href = 'http://example.com/index.php';
    }
}, 2000);//2000 = 2 seconds or whatever it might take for parent to send variable.

and possibly for non js version.

<noscript>
    <meta http-equiv="refresh" content="0; url=http://example.com/index.php"><!-- 0 = seconds -->
</noscript>

How to avoid user to open popup directly in the browser?

2 Answers2