Hi Bennett,

you simply cant depend on the HTTP_REFFERER, because it
might not be present at all (netscape tends to this somethimes,
or the users site have some sort of proxy which filters it out)
or might even be incorrect. Either by incorrect browsers
or simply by faking it. Please note: every header from
useragent can and will be faked if nessecary. So dont
built up security or the like on them.

Regards
Tino Wildenhain

--On Mittwoch, 16. Mai 2001 00:13 -0700 Bennett Haselton 
<bennett(at)peacefire.org> wrote:

> Since I've started logging the HTTP_REFERER variable submitted by browsers
> when they visit the Peacefire.org site, I've noticed a few that don't
> begin
>
> with "http://", and they're all submitted by variants of Internet Explorer
> 5.x. The Referer value "peacefire.org" or "www.peacefire.org" was detected
> being submitted at least once by all of the following user-agents:
>
> Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
> Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
> Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)
> Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)
> Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
> Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
>
> This is incorrect behavior -- if the "Referer:" field contains a URL, it's
> supposed to include the full URL with "http://" at the beginning. I
> thought a Referer: like "peacefire.org" (with no "http//") might get
> submitted if you type "peacefire.org" into the IE address bar, but I tried
> that and it doesn't submit anything in the "Referer:" header if you do
> that. Any idea what's causing this?
>
> I just want to find out if this is an IE 5.5 bug that I have to take into
> account, if I'm writing an application that depends on the value of
> HTTP_REFERER.
>
>           -Bennett
>
> bennett(at)peacefire.org     http://www.peacefire.org
> (425) 649 9024
>

• Web Designer Courses
• Off the Shelf Training Courses

HWG: hwg-servers mailing list archives, maintained by Webmasters @ IWA