How to tell where the user is coming from?

Question

Is there a reliable way to determine where a user is coming from in an ASP.NET application? We have a web application that is linked to from two different locations. The two links are on separate domains, and they need to dictate certain user permissions within this app. Here's what I have tried so far...

• Using Request.UrlReferrer (which is the Referer HTTP header). This always returned an empty string. I believe this is because the hyperlinks use Javascript to launch a popup window. Based on my research, the user agent provides this HTTP header on standard hyperlinks. Javascript popups are a different story (evidently).

• A simple query string to indicate the referrer. This is not really an option because we need something that is not so easy to bypass (more secure).

Any ideas? I understand that in the grand scheme of things, this could have a better overall design/structure. Please don't post an answer suggesting I re-design everything, because that is not an option.

Answer 1

Without the browser passing a referrer or using the querystring like you describe, there is no way to know.

Answer 2

There's no a reliable way to tell where an user is coming from and this is not only an ASP.NET limitation, but all web applications in general. The url referrer can be easily spoofed so it is not reliable. I think the best option could be some encrypted url parameter, or cookie if you prefer.

So both pages should agree on common private keys.

1. Page1 will use the key to encrypt its address and pass it to Page2
2. Page2 will check for the presence of this parameter and try to decrypt it with the same private key used to encrypt
3. If this succeeds it means that Page2 will be capable to determine who called it, if not, the data has been tampered

Answer 3

Another option is to have two different landing pages on the ASP.NET application. The landing pages can set the security options and then redirect to a common homepage. This is a little more secure than the querystring option.

Or, you could place a 1x1 pixel image on the referring sites that is pulled from your ASP.NET application site. The referrer should be passed to the script and you could then set a cookie on the users machine that you can then reference when they hit the app homepage.