Change URL by client

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

hello everybody,
i have a security-related question,
how can i detect if the client has changed the URL in his browser in my web
application

thanx.
 
itgMan said:
hello everybody,
i have a security-related question,
how can i detect if the client has changed the URL in his browser in my
web
application
Click to expand...

What do you mean, "changed the URL", and why do you want to do this?

This sounds like one of those "how can the server get more control over the
client" questions. The answers to those questions are usually things like,
"you can't", and "you can write your own web browser", and "web forms and
windows forms aren't the same thing". You'll get a more useful answer if we
have a better idea of what you're really trying to accomplish.

John Saunders
 
thank you John,
here is what i really want,
i dont want the user to surfe and go through my web application by editing
the URL in the address bar,
so i wonder if i can know that he has edited the URL,
this will help me to display a warning message telling the user not to
change it,

so is there an event in the javascript that i can use,
or is there a defferent in the HTTP header that i can use..

i have used the following method :
the HTTP_REFERER is always empty when the user navigate using the address bar,
but this did'nt help me because its also empty when a page is opened as a
popup window..
im trying to solve the problem in a diferrent manner..

thank you again.
 
itgMan said:
thank you John,
here is what i really want,
i dont want the user to surfe and go through my web application by editing
the URL in the address bar,
so i wonder if i can know that he has edited the URL,
this will help me to display a warning message telling the user not to
change it,

so is there an event in the javascript that i can use,
or is there a defferent in the HTTP header that i can use..

i have used the following method :
the HTTP_REFERER is always empty when the user navigate using the address
bar,
but this did'nt help me because its also empty when a page is opened as a
popup window..
im trying to solve the problem in a diferrent manner..
Click to expand...

Sorry, the answer is, "you can't".

The user's address bar belongs to - the user, not to you. If you want that
kind of control over the application the user uses to access your
application, then you need to write one yourself and then somehow make sure
the user doesn't use somebody else's application.

But that's not how the Internet works, so you'll be wasting your time to try
to solve this problem. Instead, you should make sure that this problem isn't
a "problem" for you. Make sure that the user (or better still, the Hacker)
can use any URL they like without compromising the security of your
application. If you can't do that, then you need for your application to not
be on the Internet at all.

And BTW, you can't stop them from using the BACK button or from pressing
Refresh or clicking the Submit button more than once.

John Saunders
 
Back
Top