Re: HTTP_REFERER <-> Norton firewall

HTTP_REFERER is set by the browser, so you can not rely on that! cheers, Merlin "Martin Christian Koch" <martin@koch.dk> schrieb im Newsbeitrag news:000801c32162$8f90d0d0$0100a8c0@koch... > Due to the fact that Norton firewall takes control of the value of > HTTP_REFERER, I want to find another way to secure data. > > This is the setup : > > picserver = apache server with PHP4 - acts as upload / output of jpeg > server > www = apache server with PHP4 - this is where the website runs from > > Now - on www I'm posting through a form a file upload directly to > picserver. > The receiving PHP-script checks the HTTP_REFERER - if it's NOT www, you > will > not be able to upload the picture. Now - under normal circumstances this > is > working fine, but NOT for users using Norton firewall, since > HTTP_REFERER is > altered. > > Outputting pictures is done like this : > > <a href=http://picserver/output.php?c=code> running on > www. > output.php contains a script which checks 'c' and outputs like this : > > if ($HTTP_REFERER == "www") { > header("Content-type: image/jpeg"); > readline("picture.jpg"); > exit; > } > > Now - under normal circumstances this works fine - but again - > HTTP_REFERER > is altered so Norton users are not able to view the pictures. > > How do I set security so that only www has access to picserver - so that > noone else are able to misuse the server. > > Thanks for any advice, > Martin > >