How to get IP of server that initiated redirect

Question

Hi,

I hope you could help me with the following question:

A user clicks a hyperlink in a page. Server A handles the request and redirects the client to a URL on Server B (more specifically I am using the Response.Redirect method in .NET on server A).

I have been asked to restrict access to Server B to redirects originating from Server A only (by blocking IP's other than Server A's). At first I thought this could be achieved by using the HTTP 'referer' header, however, it seems it is up to the browser to set this to a URL (rather than IP), and it is not guaranteed to do so.

I guess there is no way to set the HTTP 'referer' on server A in .NET (to server A's IP)? (my intuition is that would be a security hole). So my question is, how can I restrict access to Server B to redirects originating from Server A?

Any help much appreciated,

Martijn

Answer 1

No you cannot do it that way, browsers only set the referrer in certain conditions and a client can spoof this.

The referrer header is a request header - not a response header, so Server A cannot set this.

You would have to do something server side (a token perhaps) so long as you are in control of both servers, then pass the token as a parameter in the URL you redirect to.

Answer 2

you could send a signed message in the redirect process, so that server B can verify that it was signed by server A

Answer 3

Let me tell you how I understood your question: You have a set of web pages(p1,p2,p3,p4) distributed on two servers A(p1,p2) and B(p3,p4). clients can click links to pages p1,p2 that redirect the user to pages p3,p4 through server A to server B.

you want users be restricted so that they cannot access pages p3,p4. In other words get server B restrict access to pages p3,p4 except through redirects generated by server A.

If I got the point this way you can let server A appends a query string to the url while redirect and let server B check that query string and instead of using Response.Redirect from server A you can use Server.Transfer in order to hide the url from the user.