Question

I have this following code:

if (Request.UrlReferrer != null)
        {
            if (Request.UrlReferrer.PathAndQuery.ToLowerInvariant() == "/test/content.htm")
            {
                postbacklink = Request.UrlReferrer.AbsoluteUri.Replace("/TEST/Content.htm", "/Testing.aspx?")  + Request.QueryString;
            }
            else
            {
                postbacklink = Request.UrlReferrer.AbsoluteUri;
            }
        }
        ExtendedLoanView.PostbackLink = postbacklink;

Now this page can be accessed by two different locations. Which means this code:

 postbacklink = Request.UrlReferrer.AbsoluteUri.Replace("/TEST/Content.htm", "/Test.aspx?")  + Request.QueryString;

can only work with one page (Test.aspx) and is hard coded. So in IE7 Request.UrlReferrer shows me this:

Request.UrlReferrer = {http://Testing:12345/PPP/Content.htm}

Whereas in IE8+ I am getting this value:

Request.UrlReferrer = {http://Testing:12345/PPP/TestingPage.aspx?Name=Xyz&Address=123 YYY

How should I solve this issue? Its been bugging me for past month.

Answer 1

I would definitely advice not to base your logic on request information (not anymore than user entered values). The thing is that it will be different across browsers, and it is really hackable.

If you still need to pass information from client to server, make sure to have those validated. If you need those to stay in sync and have valid information, do not rely on what the browsers give you, but set it yourself and then take it from a place in the request you did set (for example, a hidden input, a control, a variable on the viewstate, or whatever allows the technology you’re using).

Most sites handle the situation you’re trying to solve by passing the destination URL in the URL itself, in a query parameter. For example:

http://www.example.com/Login.aspx?returnUrl=/TEST/content.htm

EDIT: I do realize that everything you send to the client is very hackable anyway, but if you set it yourself, it’s easier for you to validate that it hasn’t been tampered with. An example is the ViewState validation methods.