RE: Htaccess code to Deny Referrers Spam?

> -----Original Message-----
> From: Warron French [mailto:wfrench <at> xtria.com]
> Sent: Montag, 31. Januar 2005 17:10
> To: users <at> httpd.apache.org
> Subject: RE: [users <at> httpd] Htaccess code to Deny Referrers Spam?
> 
> 
> Joshua,  
>     what does the Referer:  line do for you while you are 
> testing?  I guess what I am asking is...  what practical 
> purpose does it serve to do it sometimes and not others?

Are you asking in the context of this particular thread? If so, it is
simply to trigger the RewriteCond that the user wanted to test (so
avoiding having to wait for a "real" request from the web).

Or are you asking what's the point of the Referer in HTTP generally? If
so, it is just one of many optional headers that the client may add to
the request (you can read all about them at
http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.3). The
Referer header is specifically discussed in
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.36.

To give you a quick digest; its purpose is to tell the server what page
the user was on when he clicked on the link to submit the current
request. This is useful, for example, for finding broken links, auditing
user click-trails and restricting people from hot-linking your images.
One limitation is that the content of the Referer is entirely up to the
client and so it is easy for a dishonest client to spoof the header and
so circumvent any "security" mechanism you might try to build using
this.

Rgds,
Owen Boyle
Disclaimer: Any disclaimer attached to this message may be ignored. 

> 
> 
> 
> Warron French
> Sr. Network Engineer
> Xtria, LLC
> 
> -----Original Message-----
> From: Vik Rubenfeld [mailto:vikr <at> mindspring.com]
> Sent: Thursday, January 27, 2005 7:15 PM
> To: users <at> httpd.apache.org
> Subject: Re: [users <at> httpd] Htaccess code to Deny Referrers Spam?
> 
> 
> On 1/26/05 12:11 PM, "Joshua Slive" <jslive <at> gmail.com> wrote:
> 
> > Test it yourself by manually
> > constructing a request as in
> > 
> > telnet yourhost 80
> > GET /page.html HTTP/1.0
> > Host: yourhost.example.com
> > Referer: http://poker-whatever.com/
> > [enter]
> 
> Great stuff. Thanks, Joshua.
> 
> -Vik
> 
> 
> 
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP 
> Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe <at> httpd.apache.org
>    "   from the digest: users-digest-unsubscribe <at> httpd.apache.org
> For additional commands, e-mail: users-help <at> httpd.apache.org
> 
> 
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP 
> Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe <at> httpd.apache.org
>    "   from the digest: users-digest-unsubscribe <at> httpd.apache.org
> For additional commands, e-mail: users-help <at> httpd.apache.org
> 
> 
Diese E-mail ist eine private und persönliche Kommunikation. Sie hat
keinen Bezug zur Börsen- bzw. Geschäftstätigkeit der SWX Gruppe. This
e-mail is of a private and personal nature. It is not related to the
exchange or business activities of the SWX Group. Le présent e-mail est
un message privé et personnel, sans rapport avec l'activité boursière du
Groupe SWX.

This message is for the named person's use only. It may contain
confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please notify the sender urgently
and then immediately delete the message and any copies of it from your
system. Please also immediately destroy any hardcopies of the message.
You must not, directly or indirectly, use, disclose, distribute, print,
or copy any part of this message if you are not the intended recipient.
The sender's company reserves the right to monitor all e-mail
communications through their networks. Any views expressed in this
message are those of the individual sender, except where the message
states otherwise and the sender is authorised to state them to be the
views of the sender's company. 

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe <at> httpd.apache.org
   "   from the digest: users-digest-unsubscribe <at> httpd.apache.org
For additional commands, e-mail: users-help <at> httpd.apache.org