Member Avatar for Taffd

Happy New Year everyone.
Does anybody know how I can restrict access to a page to those users coming from a specific url.

Thanks in advance
Taffd

  • 5 Contributors
  • 5 Replies
  • 114 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by Fest3er

Dani AI

Generated

A few quick notes that build on what and suggested.

IP blocking or .htaccess rules (as showed) can stop hosts but cannot enforce "coming from a specific URL." The HTTP Referer header (what mentioned) is useful for convenience checks but is unreliable and can be omitted or forged. For anything more robust than a casual gate, use a server-controlled token or session flow rather than trusting referer or client-sent headers.

Recommended pattern (server-issued, short-lived token):

  • When rendering the allowed page, create a signed token that encodes the target page and an expiry timestamp. Embed that token in the link or a hidden POST field.
  • On the protected page, validate the token server-side: check signature, check expiry, optionally mark it used (store one-time tokens in a small table or cache).
  • Always deliver these tokens over HTTPS and keep the signing secret out of webroot/config repos.

Example (PHP) for generation/validation:

function make_token($page, $ttl, $secret) {
    $expiry = time() + $ttl;
    $data = $page . '|' . $expiry;
    $sig  = hash_hmac('sha256', $data, $secret);
    return base64_encode($data . '|' . $sig);
}

function verify_token($tokenB64, $expectedPage, $secret) {
    $raw = base64_decode($tokenB64, true);
    if (! $raw) return false;
    list($page, $expiry, $sig) = explode('|', $raw);
    if ($page !== $expectedPage) return false;
    if ($expiry < time()) return false;
    $expected = hash_hmac('sha256', $page . '|' . $expiry, $secret);
    return hash_equals($expected, $sig);
}

Notes and troubleshooting:

  • Use short TTLs (minutes). If tokens must be single-use, record them in Redis/DB and delete on use.
  • Prefer session-based gating (set a session flag on the referring page) for same-site flows.
  • If you need true access control, require authentication instead of relying on origin checks.

Recommended Answers

All 5 Replies

Member Avatar for MitkOK

Hi.

Here is two simple ways to do this :

First way is to use .htaccess file :

deny from 111.222.333.444
deny from 222.333.444.555

Second way is php code :

<?php

$ipaddress = getenv("REMOTE_ADDR");

if ($ipaddress=='111.222.333.444' || $ipaddress=='222.333.444.555') {
    exit;
   }

?>
Member Avatar for Taffd

Excellent MitkOK, Thanks very much.

Member Avatar for Member #202627

nice solution

Member Avatar for vssp

Thanks MitkOK ,

I know htaccess file restriction , But i dont know ip address solution

Thanks

Member Avatar for Fest3er

If you want to restrict access to those users who clicked a link on a specific web page, you would have to use PHP and reference $_SERVER. But this value can't really be trusted. From the PHP manual:

The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

This is about as good as you can get if you want to be sure people arrive at your page by clicking a link on another specific page; there is no easy way to tell how someone arrived at a page.

Well, perhaps you could create a session cookie that stores the URL (or an ID code) of the page visited on your web site. Then the first thing your protected page does is check the cookie. If it contains the right URL or code, you set the cookie to the protected page's URL or code and allow access. If not, you send her elsewhere (maybe redirect to blank:, maybe to a random search on Google, maybe to an error). Of course, this means that *every* page of your web site must set the cookie.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.