in reply to Another way to find http referrer

Even if you can trust the referer, it's only going to tell you that the previous request used https, not the current one.

Isn't it easier to configure the HTTP server to only accept https connections?

REMOTE_ADDR can be faked, but is harder to do. But that doesn't give you any information whether the request was using https or not.

As a general advice, don't roll your own security. Leave it to the experts, and do it at the right layer.

Replies are listed 'Best First'.
Re^2: Another way to find http referrer
by Anonymous Monk on Feb 28, 2012 at 11:05 UTC

    Just to add: browsers generally don't send a referrer if they are coming from a secure site (https) to an insecure one (http)

[reply]
Re^2: Another way to find http referrer
by Anonymous Monk on Feb 27, 2012 at 22:57 UTC
    JavaFan, these scripts are on shared server and I have other scripts which must be http. Can I do something with .htaccess or something to only act on my 3 scripts? Thank you.
[reply]

      A simple solution: configure your web server to serve files for your https:// URLs from a different point in your filesystem than your http:// files. For instance, your http files might be under /var/www/data and your https files under /var/www/data-ssl. Then neither set of files can be accessed through the other port.

      Edit: On a second look, I noticed you said you're on a shared server, so maybe you can't change the web server config. In that case, the $ENV{HTTPS} or $ENV{SERVER_PORT} variables may be of use to you, at least on some servers.

      Aaron B.
      My Woefully Neglected Blog, where I occasionally mention Perl.

[reply]
        Thank you very much Aaron. Did not know about that. I search and found all information which said things about 'corresponding PassEnv directive', but I test it with my script now and it works. $ENV{'HTTPS'} is 'on' when I go https. Thank you again.
[reply]
      Can I do something with .htaccess or something to only act on my 3 scripts?
      I don't know. Probably. But you'd have to be at the Apachemonks for that.
[reply]
        I don't know

        JavaFan, I now been looking at your 4054 write-ups. I think you do know.

[reply]

In Section Seekers of Perl Wisdom