Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #18736 > unrolled thread

how to test browser referer behaviour

Back to article view | Back to comp.lang.javascript

Contents

  how to test browser referer behaviour ñull <comunica2sc@gmail.com> - 2013-03-06 10:34 -0800
    Re: how to test browser referer behaviour Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-03-06 20:32 +0100
      Re: how to test browser referer behaviour John G Harris <niam@jghnorth.org.uk.invalid> - 2013-03-07 10:29 +0000
    Re: how to test browser referer behaviour Danny <dann90038@gmail.com> - 2013-03-07 15:10 -0800
      Re: how to test browser referer behaviour Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-03-08 20:55 +0100

#18736 — how to test browser referer behaviour

For a security minded client I need to find a way to warn an Intranet visitor to to turn off network.http.sendSecureXSiteReferrer setting in Firefox. Ideally I would like to deny access to the Intranet users when has the default which is true (thereby sending referrer information to SSL sites). 

What would be the easiest way to detect this and to deny access. 

[toc] | [next] | [standalone]

#18737

ñull wrote:
^^^^
Your full real name belongs there.

> For a security minded client I need to find a way to warn an Intranet
> visitor to to turn off network.http.sendSecureXSiteReferrer setting in
> Firefox. Ideally I would like to deny access to the Intranet users when
> has the default which is true (thereby sending referrer information to SSL
> sites).
> 
> What would be the easiest way to detect this and to deny access.

To answer the question that you did not ask: You need to do that server-
side.  Which ECMAScript-based technology have you available there?

-- 
PointedEars

Twitter: @PointedEars2
Please do not Cc: me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#18745

In message <1614071.01Opu7qCcv@PointedEars.de>, Thomas 'PointedEars'
Lahn wrote:
>ñull wrote:
>^^^^
>Your full real name belongs there.
  <snip>

A sensible person would seek evidence that it's not a full real name
before criticising.

And a sensible person would define what he means by 'full real name'.
Does it include all the names of a good many Spaniards, such as José
María Álvarez de Sotomayor. That would be ridiculous.

  John
-- 
John Harris

[toc] | [prev] | [next] | [standalone]

#18757

To ñull

I don't think js has access to objects to such object from the UA, js wise you may end up needing something like a signed script from your server, to gain extra access to other 'security' objects, but even then can't say if the object will be exposed to js.  Otherwise, as others have suggested, you'd need to do network monitoring on the server side, which I'm sure it can pick up insecure clients.

[toc] | [prev] | [next] | [standalone]

#18779

Danny wrote:

> To ñull
> 
> I don't think js has access to objects to such object from the UA, js wise
> you may end up needing something like a signed script from your server, to
> gain extra access to other 'security' objects, but even then can't say if
> the object will be exposed to js.  Otherwise, as others have suggested,
> you'd need to do network monitoring on the server side, which I'm sure it
> can pick up insecure clients.

Signed scripts are no longer supported, and were only ever supported by 
Mozilla browsers.

And you are still not posting properly (attribution, line length, and all).  
Read the FAQ, <http://jibbering.com/faq/#posting> or 
<http://PointedEars.de/faq#posting>.

-- 
PointedEars

Twitter: @PointedEars2
Please do not Cc: me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web