Referral URL Only Occess

j_holmes · December 3rd, 2004, 01:15 AM

Hi,
I'm trying to restict access to
my website by referral site only.

I have a login page for my website,
the problem is that when my users login,
there's nothing stopping them from bookmarking
the page they logged into. Now when it comes to the
other pages on my site. they're sort of protected by
the frame that I inserted into my actual homepage, keeping
in mind that it's just classmates I want to restrict, so the
need for fort-nox is not needed. But I really want to make the
homepage accessible by a referral site (login page) only. If anyone
knows of all, or any means (easiest way hopefully) on how to do this,
it will be greatly appreciated.

Thanks.

Holmes

vinod_yadav1919 · December 3rd, 2004, 05:35 AM

Hii j_holmes

If you are talking about javascript solution then you can use
(document.referrer) and make assure that visitors are coming from your given
referral sites only.

If you are talking about asp/php then user servervariables,

Another apporach is that use session variables/cookies to store userid,and checked it to track user.

Even if the user is bookmarked your page,he has to be login through the login page,next time when he is visited to ur site.

Hope you get the solution

Cheers :)

vinod

j_holmes · December 3rd, 2004, 11:14 AM

Hi
vinod_yadav1919.

Thanks for replying.

I have know knowledge of asp/php, but
using (document.referrer) sounds good to me
Although I never heard of it, lately I've been
messing around with javascripts, and would probably be
able to do what you mentioned. Do you know of a website
that instructs on how to? Or is it explainable within this
forum?

Thanks again for your reply..

Holmes

vinod_yadav1919 · December 4th, 2004, 03:46 AM

Hii _holmes,

I am also a beginner in javascript,let i try to explain it

Suppose that i have an link on other web site for example "http://xyzabctemp.com/foldername/page1.asp" or(html/whatever extension) ,that points to your web site e.g

<a href="http://j_holmes_site_url1/foldernames/filename1.asp">Move to Jholmes Site</a>

Now when i clicked on above url, i will be on your web site
i.e.on my browser address(same instance of the browser/or right clicked and open in new window)
)

now your site have a javascript function that checks whether i coming from your given referral site or some fake site.

and this javascript code will check

<Script>
originated_from=document.referrer //("http://xyzabctemp.com/foldername/page1.asp")
domainname=from.substring(from.indexOf("//")+2,from.length)
domainname=domainname.substring(0,domainname.index Of("/"))
alert(domainname) //it will be xyzabctemp.com

if(domainname=="listedurl")
{
//proceed
}
else
{
//invalid referral
location.href="urloginpage"
}
</Script>
Now you can match the domainname with the referral url in your list :)

May be after some time your referral sites change(30 to 40 sites) ,so its better to put ur referral site information
on the database and ,put this function to global javascript function,so that u need not be put the same code all the pages

Hope this will help you :)

Cheers :)

vinod

j_holmes · December 5th, 2004, 11:49 AM

Hi vinod_yadav1919,

Thanks for your reply.

About that script, Where do I past it, head or body?

Also, when you said

" May be after some time your referral sites change(30 to 40 sites) ,so its better to put ur referral site information
on the database and ,put this function to global javascript function,so that u need not be put the same code all the pages"

I dont understand, the referral sites will only change to
(30 to 40 sites) if i input them right?

So using this script will deny access to anyone not coming from the referral site?

Thanks again.

Holmes

vinod_yadav1919 · December 5th, 2004, 01:16 PM

paste the code in <head></head>
i.e.
<head>
<Script>
function IsValidReferral()
{
originated_from=document.referrer //("http://xyzabctemp.com/foldername/page1.asp")
domainname=from.substring(from.indexOf("//")+2,from.length)
domainname=domainname.substring(0,domainname.index Of("/"))
alert(domainname) //it will be xyzabctemp.com

if(domainname!="xyzabctemp.com")
{
//invalid referral
location.href="urloginpage"
}

}
//now call your function
IsValidReferral();

</Script>
</head>

Currently you have only one referral(xyzabctemp.com) so you hardcoded this comaparison,
now,when you have more Referrals(say about 50 sites),then ?? do you always try to change your
IsValidReferral() function??

If you store this referral information in the database/textfiles ,then only you need to do make an new
entry in the database/text files.

Array is also a good idea :),
Sorry,By mistake ,In previous code i wrote (originated_from) read it as (from) only
Since in below example i am coming from
http://xyzabctemp222.com/foldername/page1.asp
which is not a referral site, below code will redirect my browser to "urloginpage"

<script>
function IsValidReferral()
{
from=document.referrer//("http://xyzabctemp222.com/foldername/page1.asp")
domainname=from.substring(from.indexOf("//")+2,from.length)
domainname=domainname.substring(0,domainname.index Of("/"))
var referal_list=new Array("xyzabctemp.com","xyzabctemp1.com","xyzabcte mp2.com");

flag=false;
    for(i=0;i<referal_list.length;i++)
    {
     if(domainname==referal_list[i])
        {flag=true
           break;
        }
    }
          alert(flag)
    if(!flag)
    { //Error
    //It's not a referral site,Move to your login Page
    location.href="urloginpage"
    }

}
IsValidReferral();
</script>
Hope this will help you :)

Cheers :)

vinod

j_holmes · December 5th, 2004, 02:06 PM

Hi, it's me again.

I know I'm sounding like an idiot, but I tried what you said,
and when I'm coming from my login page now, its says false.
Here's how i set it up:

<script>
function IsValidReferral()
{
from=document.referrer//("not quite sure what to put in here(everything but login page")
domainname=from.substring(from.indexOf("//")+2,from.length)
domainname=domainname.substring(0,domainname.index Of("/"))
var referal_list=new Array("http://home.cogeco.ca/~grimreaper/","xyzabctemp1.com","xyzabctemp2.com");

flag=false;
    for(i=0;i<referal_list.length;i++)
    {
     if(domainname==referal_list[i])
        {flag=true
           break;
        }
    }
          alert(flag)
    if(!flag)
    { //Error
    //It's not a referral site,Move to your login Page
    location.href="http://home.cogeco.ca/~grimreaper/"
    }

}
IsValidReferral();
</script>

Does this make sense?

Sorry for being a greenhorn

Thanks again..

Holmes

vinod_yadav1919 · December 5th, 2004, 03:24 PM

Hii Holmes,

suppose that ,you have a page say "http://home.cogeco.ca/~grimreaper/CriticalPage1.html"

This page should be visible only for login user or some referal sites.

Now think you want to allow only those users who come from the "referal_list"
i.e("http://www.xyzabctemp1.com","http://www.xyzabctemp2.com","http://www.xyzabctemp1010.com")

Any user who is coming from other site say "http://vinod_yadav1919test.com/test.asp" should not have
access to your site.
May be the owner of vinod_yadav1919test.com, put a link to your site by just adding a href tag,so that
other users can access your sites(Note even in this time Vinod_yadav1919test.com is not a valid referal site) and i am puting the Code in my "test.asp" page like this
<a href="http://home.cogeco.ca/~grimreaper/CriticalPage1.asp">Visit Holmes Site</a>

Now when user clicks the link to above "Visit Holmes Site", your url will be in the user address bar,
then your javascript function check from which sites the request is made.

In this case value of the variables willbe

document.referer will be (http://vinod_yadav1919test.com/test.html)
i.e
"from"->http://vinod_yadav1919test.com/test.html [Originating site of the request]
"domainname"->"vinod_yadav1919test.com"

1) You do not need to put in the "from" variable,
  It is the url of the Referer page(May be it is your given referral site or some other site)

2)You do not need to put "http://home.cogeco.ca/~grimreaper/" in the array
Basically referal_list is the name of all the sites to whom you allowed to see/access your pages

3)Any other sites which are not in the "referal_list" , will directly move to your login page

from=document.referrer
var referal_list=new Array("xyzabctemp1.com","xyzabctemp2.com","xyzabct emp1010.com")
location.href="http://home.cogeco.ca/~grimreaper/loginpage.html

Please put the comment for alert(flag),i forgot to comment it :(
In More Depth?
Save below code as "test.html"
*************************** test.html start**************
<script>
function IsValidReferral()
{
from=document.referrer
domainname=from.substring(from.indexOf("//")+2,from.length)
domainname=domainname.substring(0,domainname.index Of("/"))
var referal_list=new Array("xyzabctemp.com","xyzabctemp1.com","xyzabcte mp2.com");

flag=false;
    for(i=0;i<referal_list.length;i++)
    {
     if(domainname==referal_list[i])
        {flag=true
           break;
        }
    }

    if(!flag)
    {alert("You are Invalid User"+from)
    //It's not a referral site,Move to your login Page
    location.href="http://home.cogeco.ca/~grimreaper/"
    }
      else
      {alert("success")
       }
}
IsValidReferral();
</script>

*********************test.html end **********************

and Make a new page "check.html" and put a link
******************check.html start**********
<a href="http://home.cogeco.ca/~grimreaper/test.html">Test the Site</a>

****************check.html end*********

NOw ,Try to open your page by in the browser
http://home.cogeco.ca/~grimreaper/check.html and click the the Link on that page

Cheers :)

vinod

j_holmes · December 5th, 2004, 08:48 PM

Hi vinod_yadav1919,

I know this is going to work,

o.k., i set up the test like you said,

worked.

but i went further and changed the referral to the check.html,
and it still didnt let me in.

plus when the warning pop's up, the "You are Invalid User:http://home.cogeco.ca/~grimreaper/check.html"

has no space between them,

am i still doing something wrong here?

again, so sorry for being such a greenhorn..

thanks again.

Holmes

vinod_yadav1919 · December 5th, 2004, 09:06 PM

OK,
If you want space between them?
then use a space lik
alert("You are Invalid User coming From " +from)

Try to replace
location.href="http://home.cogeco.ca/~grimreaper/"
by
location.href="http://home.cogeco.ca/~grimreaper/loginpage1.html"

do not put the same script function in the "loginpage1.html"

to test it just create a new html page with name"loginpage1.html" ok :)
Questions are always welcome !!

Cheers :)

vinod