Page referer not getting set

[Joshua Beall]

Hi All,

I do web design for some small organizations, and one of the sites I have
set up takes online conference registrations. Now, most of the time it
works. In fact, every time I try it, it works fine.

However, after having many complaints about it not working right, I finally
discovered that some of my users do not have the page referer set when they
request my page, and I was checking on the form submission page to make sure
that the referer was the correct page.

What could cause people to not have their referer set? What is the solution
for this sort of problem? Just don't check the referer?

-Josh

[Tom Thackrey]

On 13-Feb-2004, "Joshua Beall" <jb****@donotspam.remove.me.heraldic.us>
wrote:

I do web design for some small organizations, and one of the sites I have
set up takes online conference registrations. Now, most of the time it
works. In fact, every time I try it, it works fine.

However, after having many complaints about it not working right, I
finally
discovered that some of my users do not have the page referer set when
they
request my page, and I was checking on the form submission page to make
sure
that the referer was the correct page.

What could cause people to not have their referer set? What is the
solution
for this sort of problem? Just don't check the referer?

Some browsers and many of the popup blockers allow the user to block the
referrer making it undependable.

--
Tom Thackrey
www.creative-light.com
tom (at) creative (dash) light (dot) com
do NOT send email to ja*********@willglen.net (it's reserved for spammers)

[Ash Argent-Katwala]

On Sat, 14 Feb 2004, Joshua Beall wrote:

What could cause people to not have their referer set? What is the solution
for this sort of problem? Just don't check the referer?

The specs?

Take a look at section 15.1.13 of RFC 2616:

: ...it is strongly recommended that the user be able to select whether or
: not the Referer field is sent.

<http://www.w3.org/Protocols/2616/rfc2616-sec15.html#sec15.1.3>

It has always been an optional field. Relying on the referer to be set to
some particular URI(s) you expect them to arrive from will break people
trying to link to your page[0] from elsewhere, and your pages from working
at all for some users. In general, this is poor practice.

I've also seen institutional browsers sometimes set to always send the same
fixed Referer, so just checking non-blank Referers will hurt some folk too.

0 - loosely. Really whatever you're returning from the script, be it page,
image or whatever else.

--
ash
a-k
.... Why is there so much month left at the end of the money?

[Joshua Beall]

"Ash Argent-Katwala" <as*@videdot.com> wrote in message
news:Pi**************************************@tung sten.doc.ic.ac.uk...

On Sat, 14 Feb 2004, Joshua Beall wrote:

What could cause people to not have their referer set? What is the solutionfor this sort of problem? Just don't check the referer? Take a look at section 15.1.13 of RFC 2616:

: ...it is strongly recommended that the user be able to select whether or
: not the Referer field is sent.

Hmm, good point.
It has always been an optional field. Relying on the referer to be set to
some particular URI(s) you expect them to arrive from will break people
trying to link to your page[0]

Well, you do not always want your pages to be linked from elsewhere, so that
is not a really good reason to not use it. But obviously the fact that it
is considered optional is reason enough, indeed.

Thanks!

[John Dunlop]

Ash Argent-Katwala wrote:

I've also seen institutional browsers sometimes set to always send the same
fixed Referer,

This seems silly to me. Nowhere in RFC2616 says that fake referrer
information can be sent by the client.

--
Jock

[Ash Argent-Katwala]

On Mon, 16 Feb 2004, John Dunlop wrote:

This seems silly to me. Nowhere in RFC2616 says that fake referrer
information can be sent by the client.

Indeed. I'm just not sure I want to poke people in the eye for having it
configured that way (when it's likely their network/systems admin who's
done that to their setup and they can't necessarily do anything about it).

--
ash
a-k
.... Have you noticed how we only win the World Cup under a Labour government?