Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #9910

Re: $referrer = $_SERVER['HTTP_REFERER'] echo

Show all headers | View raw

Christoph Michael Becker wrote:

> Thomas 'PointedEars' Lahn wrote:
>> Also, I would let match RFC 3986, Appendix B, against a URI.  What if
>> there is a query part, for example?
> 
> Good point!  However, only recently there was a bug report regarding
> PHP's filter_var($var, FILTER_VALIDATE_URL)[1].

I have not suggested using filter_var().

> This is meant to be implemented according to RFC 2396; obviously RFC 2396
> is obsoleted by RFC 3986

Since 8 years now. 

> (I was not aware of that until now--thank you).

You're welcome.

> Anyway, it seems the regular expression given in Appendix B of RFC 2396
> *seems* to be more permissive than the actual syntax given in Appendix A.

Appendixes are not normative.  Assuming relevance, in which way does it seem 
more permissive?

> I have not checked RFC 3986 regarding this issue yet.
> 
>> But I would never check against the HTTP-Referer [sic!] in the first
>> place. There are much more reliable solutions, like session variables. 
>> See also <https://owasp.org/>.
> 
> ACK.  OTOH I have some concerns regarding cookies (I do not "like" to
> propagate session IDs as a GET parameter) due to the European cookie
> law(s).

Directive 95/46/EC does not apply here.

> [1] <https://bugs.php.net/bug.php?id=65141>


PointedEars, IANAL
-- 
Prototype.js was written by people who don't know javascript for people
who don't know javascript. People who don't know javascript are not
the best source of advice on designing systems that use javascript.
  -- Richard Cornford, cljs, <f806at$ail$1$8300dec7@news.demon.co.uk>

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

$referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-27 17:23 -0400
  RESOLVED Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-27 17:34 -0400
  Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-27 23:40 +0200
    Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 00:19 +0200
      Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 02:16 +0200
        Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 10:56 +0200
          Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 20:03 +0200
            Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 21:49 +0200
              Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 22:37 +0200
                Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 23:55 +0200
      Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-28 13:49 -0400
        Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 20:13 +0200
    Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-28 13:33 -0400
  Re: $referrer = $_SERVER['HTTP_REFERER'] echo Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-27 17:52 -0400
    Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-28 14:07 -0400
      Re: $referrer = $_SERVER['HTTP_REFERER'] echo Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-28 15:26 -0400
        Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-28 16:03 -0400
          Re: $referrer = $_SERVER['HTTP_REFERER'] echo Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-28 16:07 -0400
            Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 22:46 +0200
              Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 23:58 +0200

csiph-web