Re: Implementing Referer check - HTTP Header

>  match pattern should only work if the request (referer) is a 
> particular domain due to security reason.
May still allow an attacker to spoof the dns name - or are you using an 
ip address?

On 03/30/2011 09:28 AM, Gaurav Kalia wrote:
> I am not very much clear with the implementation.
>
> *What i want to achieve is --* match pattern should only work if the 
> request (referer) is a particular domain due to security reason. I  
> guess this will not allow any hacker to use client side code anywhere 
> else to use the functionality deployed on my server.
>
> *Scenario is *-- from home page (index.html) i am calling test.html 
> which contains index.html in referer. So i want test.html to only work 
> if referer comes from my own domain.
>
> Please let me know if i am not clear.
>
> Please suggest how can i achieve this.
>
> Regards
> Gaurav
> On Wednesday 30 March 2011 01:50 PM, florent andré wrote:
>> humm...
>>
>> your referer is on index.html
>>
>> and your match on test.html
>>
>> a mail typo or the trick ? :)
>>
>> ++
>>
>> On 03/30/2011 09:19 AM, Gaurav Kalia wrote:
>>> Hi Florent
>>>
>>> Yes referer is present in the request header, see below
>>>
>>> Referer|http://localhost:8888/pub/live/index.html|
>>>
>>> Below is the match type and pattern that i am using in a module:
>>>
>>> <map:match pattern="http://localhost:8888/pub/live/test.html"
>>> type="referer-match">
>>>
>>> and the matcher entry in the module sitemap
>>>
>>> <map:matchers>
>>> <map:matcher name="referer-match"
>>> src="org.apache.cocoon.matching.WildcardHeaderMatcher"
>>> logger="sitemap.matcher.referer-match">
>>> <header-name>referer</header-name>
>>> </map:matcher>
>>> </map:matchers>
>>>
>>> Please suggest.
>>>
>>> Regards
>>> Gaurav
>>>
>>> On Wednesday 30 March 2011 04:19 AM, florent andré wrote:
>>>> Hi Gaurav,
>>>>
>>>> May use this documentation
>>>> http://cocoon.apache.org/2.1/userdocs/core/wildcardheader-matcher.html
>>>> (but ok, it's the same for this page).
>>>>
>>>> 2 questions :
>>>> 1) are you sure that your request contain a referer field ?
>>>>
>>>> 2) can you send snipet of code for matcher component component
>>>> configuration and of your pipeline ?
>>>>
>>>> ++
>>>>
>>>> On 03/29/2011 01:03 PM, Gaurav Kalia wrote:
>>>>> Hi All
>>>>>
>>>>> I want to implement to the referer check for my match pattern. I 
>>>>> think
>>>>> there is something available in cocoon.
>>>>>
>>>>> Please see the link below:
>>>>>
>>>>> http://cocoon.apache.org/2.0/userdocs/matchers/wildcardheader-matcher.html 
>>>>>
>>>>>
>>>>>
>>>>> According to the documentation i have added the matcher entry in 
>>>>> sitemap
>>>>> and added *type="referer-match"* . But after adding this i am 
>>>>> getting an
>>>>> error "No pipeline match found" although it works fine without it.
>>>>>
>>>>> I also tried adding the hostname to the match pattern but no luck.
>>>>>
>>>>> Please suggest if i am missing something.
>>>>>
>>>>> TIA
>>>>>
>>>>> Regards
>>>>> Gaurav
>>>>>
>>>>> -- 
>>>>> Gaurav
>>>>> Web Development
>>>>> Techblue Softwares& Technology Blueprint Ltd
>>>>>
>>>>> T : 08450047142 Extn: 5102
>>>>> E :[email protected]
>>>>> W :www.techblue.co.in
>>>>> www.technologyblueprint.co.uk
>>>>>
>>>>> Confidentiality Notice
>>>>>
>>>>> The contents of this email are confidential and may be privileged, 
>>>>> and
>>>>> are intended only for the use of the person or company named 
>>>>> herein. Any
>>>>> views or opinions presented are solely those of the author and do not
>>>>> necessarily represent those of Techblue software or Technology 
>>>>> Blueprint
>>>>> Limited.
>>>>>
>>>>> If you are not the intended recipient of this email or a person
>>>>> responsible for delivering it to the intended recipient, you are 
>>>>> hereby
>>>>> notified that any distribution, copying or dissemination of the
>>>>> information herein is strictly prohibited.
>>>>>
>>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: [email protected]
>>>> For additional commands, e-mail: [email protected]
>>>>
>>>
>>>
>>> -- 
>>> Gaurav
>>> Web Development
>>> Techblue Softwares&  Technology Blueprint Ltd
>>>
>>> T : 08450047142 Extn: 5102
>>> E :[email protected]
>>> W :www.techblue.co.in
>>> www.technologyblueprint.co.uk
>>>
>>> Confidentiality Notice
>>>
>>> The contents of this email are confidential and may be privileged, and
>>> are intended only for the use of the person or company named herein. 
>>> Any
>>> views or opinions presented are solely those of the author and do not
>>> necessarily represent those of Techblue software or Technology 
>>> Blueprint
>>> Limited.
>>>
>>> If you are not the intended recipient of this email or a person
>>> responsible for delivering it to the intended recipient, you are hereby
>>> notified that any distribution, copying or dissemination of the
>>> information herein is strictly prohibited.
>>>
>>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [email protected]
>> For additional commands, e-mail: [email protected]
>>
>
>
> -- 
> Gaurav
> Web Development
> Techblue Softwares&  Technology Blueprint Ltd
>
> T : 08450047142 Extn: 5102
> E :[email protected]
> W :www.techblue.co.in
>      www.technologyblueprint.co.uk
>
> Confidentiality Notice
>
> The contents of this email are confidential and may be privileged, and
> are intended only for the use of the person or company named herein. Any
> views or opinions presented are solely those of the author and do not
> necessarily represent those of Techblue software or Technology Blueprint
> Limited.
>
> If you are not the intended recipient of this email or a person
> responsible for delivering it to the intended recipient, you are hereby
> notified that any distribution, copying or dissemination of the
> information herein is strictly prohibited.
>
>