HTTP_REFERER is blank -- iis smtp nntp

iis smtp nntp : HTTP_REFERER is blank

Julian
8/19/2004 5:05:02 AM

My website runs under IIS 6 on Windows Server 2003.

A user tried to send email using one of my web forms, and received an
error from the CGI program which would occur only if the environment
string HTTP_REFERER passed to the program was blank. He is using IE 6
under Win XP, same as me, and the same error occurred twice.

What condition could cause the referer to be blank, when he has clicked
the button on my page?
--
Julian Moss
Tech-Pro Limited

ca.yahoo NO[at]SPAM just1coder
8/19/2004 9:42:18 AM

What should I check off for extended logging on IIS SMTP? All of them

Julian
8/20/2004 1:12:02 AM

[quoted text, click to view]

Ken, thanks!

The problem did indeed turn out to be someone using Norton Firewall.

I probably need to find a more appropriate newsgroup for my next
question, which is how can my CGI script check that it is only being
called from one of my own web pages if it can't rely on getting the
referer information?

--

Ken Schaefer
8/20/2004 4:19:05 PM

There is no requirement that a HTTP client (eg a browser) send a referer
header - most do though. However, some people have software installed
(usually these SOHO "security suites" like Symantec Internet Security etc)
that "blocks" the client from sending out the HTTP referer as a "privacy"
measure (these programs may also block cookies etc). This would be the most
likely cause in my opinion.

Cheers
Ken

[quoted text, click to view]

Ken Schaefer
8/23/2004 11:27:34 AM

[quoted text, click to view]

HTTP is stateless, so there's no 100% gauranteed way you can do this.

a) you can set a cookie
b) you can pass information in the querystring etc

Both can be spoofed by malicious users, but you can make it quite difficult.
For example, create a temporary session for the user using a GUID as a key,
and then roundtrip this to the client via a cookie. On the next page,
validate that the client is returning a valid cookie value. However,
client's that are blocking cookies (again using things like Norton Firewall)
will not be able to use your page.

If you really require a stateful solution, you need to look at using Java
applets, Flash controls or ActiveX plugins - things that can maintain a
continuous connection back to the server.

Cheers
Ken

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis smtp nntp

home · blog · groups

Questions? Comments? Contact the dn