Member Avatar for Johnathan

Hi I am developing a new site and would like to add a specific redirect. Here is what I would like to do.

lets say I own and have a script in a subdirectory like lets say features "so the structure looks like" " I would like to set it up so that if someone tries to link to the script in features folder they are redirected to unless they were sent there by

In short I want to make it so that only can send people to the features directory links sent from anywhere else are redirected to .

If anyone knows how to set this up please let me know. Ive been stuck on this for a while thanks.

  • 3 Contributors
  • 2 Replies
  • 120 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by djnzak

Dani AI

Generated

Short summary: the goal is to let only links originating from your own site reach the /features pages and redirect other attempts back to the home page. and pointed toward a server-side solution — that is the right direction — but relying only on the HTTP Referer is brittle. The guidance below gives practical, implementable options (including code samples) and troubleshooting notes.

Why Referer checks fail sometimes

  • Browsers or privacy extensions may strip or truncate the Referer header.
  • HTTPS -> HTTP downgrades can remove the header.
  • Automated clients and crawlers behave inconsistently.
  • Referer can be spoofed, so it should not be used for real access control.

Practical approaches (ranked by robustness)

  1. Signed, short-lived token in the link. Generate an HMAC using a server-side secret and a timestamp on the page that issues the links. Verify the HMAC and timestamp on /features and reject expired/invalid tokens. Example (server-side pseudo-PHP):
$secret = 'long_random_secret';
$expires = time() + 300; // 5 minutes
$token = hash_hmac('sha256', '/features|'.$expires, $secret);
// link: /features/?e=TIMESTAMP&t=TOKEN

Verify by recomputing the HMAC and checking expiry. Store used tokens or make them single-use to prevent replay.

  1. Short-lived server-set cookie created only when visiting the root page. Set the cookie with Secure and HttpOnly flags and check it on /features. This is simpler than sessions for this use case, but still spoofable if an attacker can set cookies for your domain.

  2. If you must use webserver rules, an Apache example to redirect when Referer does not match the site (use only for convenience, not security):

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.com [NC]
RewriteRule ^features/ / [R=302,L]

Security and troubleshooting tips

  • Use HTTPS site-wide and keep the signing secret outside webroot.
  • Log failed validation attempts and test with curl and browser dev tools to see headers and cookies.
  • Remember these techniques stop casual hotlinking or deep-linking, not determined attackers; if you need true protection, require authentication or implement server-side access control.

Recommended Answers

All 2 Replies

Member Avatar for buddylee17

Do you know anything about server side scripts (php,asp,jsp...) and which one(s) can you use on your server. Once you find that out, look into using sessions.

Member Avatar for djnzak

I would agree with buddylee17 , the best and easiest would be PHP

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.