Question

I have a page that is dynamically loaded into another page by an jQuery call. What I want is to make the loaded page accessible only if is called by the jQuery and to redirect if it’s accessed directly from the browser address bar.
How do I do that?

Thanks!

Answer 1

You can’t do this reliably. The reason is simple: everything can be faked.

Custom HTTP headers may or may not always work as well, since some firewalls strip all unknown headers. So this won’t be reliable from the always work when it should standpoint. And they can even be added to a request manually using a tool like the FireFox extension “Tamper Data”… So it won’t be reliable from the always redirect standpoint either…

Parameters won’t work , since they can be easily faked by someone who knows what they are doing. So it won’t be reliable from the always redirect when not called by jQuery standpoint.

If you’re just doing it for convenience (not from a security standpoint), go with a request parameter. If you are using it for security, I’d suggest coming up with another design, since you can’t enforce anything from the client side…