Question

One of our application will be run in an iframe, inside salesforce and I’m having troubles with accessing the referer. They’d like us to do some referer checks, to make sure the request is coming from salesforce and we’ve been given the IP addresses to check against.

My problem is that anytime I try to access the referer through either of the following two methods:

HttpContext.Current.Request.ServerVariables["HTTP_REFERER"]
HttpContext.Current.Request.UrlReferrer

it returns me null.

Any ideas how could I get hold of the referer?

PS: I’m aware that you can spoof the referer, but it’s part of the requirement.

Answer 1

If I understand the question correctly you have client sites that refer to your site by embedding IFrames in their webpages the point to your site. You wish to “ensure” that the requests are coming from host page which itself is part of a designated set of sites. The set of designated sites is described by a set of IP addresses. Does that cover it?

Tricky. First off lets assume you’ve got a referer. You will need to aquire the host name from it (easy enough using the Uri type). Then you need to resolve the IP address for the host name using DNS (again not too difficult with .NET framework).

Of course you need to get a referer and that is the trickiest bit. Browsers do not always place a referer header in the request. This is especially true when the referee address is not in the same domain as the referer, which is the case here. IOW, this is a showstopper.

A better approach to solving this problem (and is not prone to spoofing) is to use some hash based authentication. Doesn’t have to be too sophisticated (if the original requirements felt the referer testing was sufficient anyway).