Re: HTTP_REFERER is missing in SSL
| From: | Rasmus Lerdorf | Date: | Fri, 27 Jul 2001 21:48:37 +0000 |
| Subject: | Re: HTTP_REFERER is missing in SSL | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-60011@lists.php.net to get a copy of this message | ||
> I have a frameset that runs on a SSL enabled server that has two frames in it.
> One of the source is the local machine and the other one is a (outsourced
> asp !!) script in another machine without SSL.
> The non SSL one requires HTTP_REFERER to make sure it was hit from the
> authorized server.
>
> This works fine with Netscape but not with IE 5. HTTP_REFERER just wasn't
> defined.
>
> Any explanation?
Bug in IE? PHP doesn't even enter the picture here. The HTTP_REFERER
variable is defined by the web server if that information is provided by
the browser.
Keep in mind that there is absolutely no guarantee that the browser will
ever provide this information. Building anything that relies on this is a
mistake.
-Rasmus