Home/ Questions/Q 938403
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T21:38:18+00:00

I hope you could help me with the following question: A user clicks a

  • 0

I hope you could help me with the following question:

A user clicks a hyperlink in a page. Server A handles the request and redirects the client to a URL on Server B (more specifically I am using the Response.Redirect method in .NET on server A).

I have been asked to restrict access to Server B to redirects originating from Server A only (by blocking IP’s other than Server A’s). At first I thought this could be achieved by using the HTTP ‘referer’ header, however, it seems it is up to the browser to set this to a URL (rather than IP), and it is not guaranteed to do so.

I guess there is no way to set the HTTP ‘referer’ on server A in .NET (to server A’s IP)? (my intuition is that would be a security hole). So my question is, how can I restrict access to Server B to redirects originating from Server A?

Any help much appreciated,

Martijn

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    No you cannot do it that way, browsers only set the referrer in certain conditions and a client can spoof this.

    The referrer header is a request header – not a response header, so Server A cannot set this.

    You would have to do something server side (a token perhaps) so long as you are in control of both servers, then pass the token as a parameter in the URL you redirect to.

    • 0