http_referer lost using https

Question

Picture two web pages, both viewed using https. They reside on different domains.

How can I (reasonably) ensure that someone arriving at my page came via a hyperlink that resides on another (specific) domain? I only want to allow traffic from that domain. Any ideas on the best way to accomplish this would be appreciated.

I tried looking at the HTTP_REFERER, but apparently it is not being sent in this case. I know that the HTTP RFC specifies not sending the referrer info from https -> http, but does this also apply to https -> https across domains or ssl certs?

My domain runs on ASP.NET if it matters. I have no control over the source domain.

Thank you.

Answer 1

Whether or not the RFCs allow the sending of http_referer or not, you'll find that many web clients and/or the proxies or other privacy-related gateways between it and the server will remove or spoof the http_referer in the header, rending most http_referer-based "authentication" scheme partially functional at best.

If you have some collaboration with the custodian of the first https server, you may agree on passing along a time+something_else-based hash code of sort in the requests to your server. By verifying the hashcode on your end, you'll known your https visitor came from the other server [very recently].

Answer 2

Elaborating on mjv's response: you should put HMAC (RFC 2104) into the URL. Have a shared secret between the two servers, and have the originating server generate links of the form /timestamp/hmac/path. The hmac should be verified from hmac(key, timestamp+path), so that different images generate different hmacs. The target server can then decide whether the timestamp is young enough to originate from a redirect.

You can further restrict that by putting the IP address of the client into the hmac, requring that the same client that received the URL is also resolving it. That may be error-prone, though, in the presence of HTTP proxies which process only http and not https or vice versa.

Answer 3

If you've got no control over the referring site you are out of luck.

Sniff the referrer if you can, and if it's not present throw up a landing page that says "click here go to site A so you can come back here".

Additionally, spend some time working on a more robust method of accessing your 'secure' site.