Obtaining requesting form's URL?

ashisht has asked for the wisdom of the Perl Monks concerning the following question:

Dear Perl Monks,

Is it possible for a Perl-CGI script to determine what was the URL of the form where the user clicked 'submit' to reach the script?

That is, when a user submits my form at http://abc/searchForm2.cgi, the script executed is http://xyz/searchFiles.cgi. Now, within searchFiles.cgi, is it possible for me to determine that the submitting form was http://abc/searchForm2.cgi?

Thanks,
Ashish.

Comment on Obtaining requesting form's URL?

Replies are listed 'Best First'.
Re: Obtaining requesting form's URL? by tinita (Parson) on Mar 22, 2004 at 21:21 UTC
yes you can, like it was said, by adding a hidden field. using HTTP_REFERER is not recommendable (can be anything the browser wants it to be, is often not set at all and can be faked). hidden fields can be faked, too, but here is my question to you: what do you need that for? if it's for security reasons, and you need to make sure that the calling site is a specific one, then you have to use something more complex like session ids. if it's just useful but it's not dangerous for your application if the referring site is faked, then use the hidden field. if it's just for fun, use $ENV{HTTP_REFERER}	[reply]
Re: Re: Obtaining requesting form's URL? by waswas-fng (Curate) on Mar 22, 2004 at 22:11 UTC
To expand on the more secure session key format, you can tuck away the location of the form that was last accessed (generated) in your app and then when a post happens and the session ID is valid you know where the last display of information came from. If you have a more complicated site that has complex structure you can add to a "queue" like array that keeps the last lets say 10 generated page locations in the session and the form portion of the app can loop through the array and see if an acceptable page to generate the form is in the list. Another option is a flag, in this scenario you have a pair of generated form page and POST processors, when the session is accessed in such a way where the form generating section of code is called, a flag is set in the session. Then when the form is posted back to the app you can check to make sure the flag has been set and clear it to force the same path in the future. If the flag is not set you can error out and force the correct path to happen. This should help reduce the problem of tabbed viewing with the same session. -Waswas	[reply]
Re: Obtaining requesting form's URL? by tcf22 (Priest) on Mar 22, 2004 at 21:00 UTC
You should be able to use the environmnet variable HTTP_REFERER. eg. `if($ENV{HTTP_REFERER} eq 'http://abc/searchForm2.cgi'){ # Do whatever }` [download] - Tom	[reply] [d/l]
Re: Obtaining requesting form's URL? by b10m (Vicar) on Mar 22, 2004 at 21:11 UTC
As often posted, referers aren't too reliable (I for one turned "Send Referrer" off in my browser). Another solution (not too reliable neither) could be to add a hidden field in the form with the URL, or script name. Or analyze your webbrowser's access log (may be overkill, but probably works best). -- b10m All code is usually tested, but rarely trusted.	[reply]