Javascript windows.open VS htaccess

Problems trying to access pages using javascript redirect rule by htaccess

[onlinemkt]

Hi all,

Itīs my first post and Iīm going to the problem:

1. I have this code on my htaccess:

ErrorDocument 404 /404.html

AuthUserFile /dev/null
AuthGroupFile /dev/null
SetEnvIfNoCase Referer "^http://www.domain.net" local_ref=1
SetEnvIfNoCase Referer "^http://domain.net" local_ref=1

ErrorDocument 403 [domain.net...]

<Files ~ "\.htm$">
Order allow,Deny
allow from env=local_ref
allow from allowit
</Files>

2. Itīs working and blocking access to my htm files

3. the problem is when I try to access a htm file by javascript link, it send me to ErrorDocument, and it shouldnīt as the link is called from my domain.net site root.

4. I discovered that firewalls and some security software may blank referres and when I tried the document.write javascript it really returned blank.

5. How can I write a htaccess command to allow blank referrers to open htm files on my site?

6. Is it really the problem? Or thereīre other possible things I should know?

Moreover, I tried using SetEnvIfNoCase Referer "^$" or SetEnvIfNoCase Referer "^" or SetEnvIfNoCase Referer "$" and nothing worked.

Also tried at least six types of javascript functions and nothing worked.

Any tip?

Thanks friends!

[jdMorgan]

JavaScript-invoked requests generally do not provide a referrer, so that is the likely problem.

SetEnvIf Referer "^$" local_ref

should work (the "=1" is not needed). Completely flush your browser cache before testing.

Jim

[edited by: jdMorgan at 12:42 am (utc) on Feb. 5, 2008]

[onlinemkt]

MMMmmm,

Thanks, it worked, BUT, now the htm pages can be opened normaly, itīs not redirecting the access to htm pages! sad... I tried changing the javascript again but didnīt worket at all.

Is there anyway to create a conditio to read the title and access only when title is = "text"? Because at this point it seems the only solution by now.

[jdMorgan]

A couple more fixes are needed:

ErrorDocument 404 /404.html
ErrorDocument 403 /index.html
#
AuthUserFile /dev/null
AuthGroupFile /dev/null
SetEnvIfNoCase Referer "^http://www.domain.net" local_ref=1
SetEnvIfNoCase Referer "^http://domain.net" local_ref=1
#
<Files ~ "\.htm$">
Order Deny,Allow
Allow from env=local_ref
Allow from allowit
</Files>

Also, it is critical to getting accurate results that you completely flush your browser cache after any change to the code, or after successfully loading an html page; Once that page is cached by your browser, no request is made to your server until the cache expires or flushed; Therefore your server-sid code will have no effect.

I believe you would be happier using a cookies-based access control solution, rather than Referrer-based access control. Your site won't be included by search engines, it won't be possible for people to type in your URL, and the 403-Forbidden response will (as you coded it) return your home page without nay explanation, thereby confusing your visitors.

Also, some terminology: There are no redirects at all in this code. An error response is not a redirect.

Jim

[onlinemkt]

Thanks again but still didnīt worked, same problem ... it now go to htm pages directly when typed on address bar, itīs not returning to index.html.

I agree itīs not a redirect, but I need users to come from index.html before they access other sections on my site, besides all my webdesign will go away.

Anyway, if you have a better solution, please let me know, at this point I tried cgi, javascript but nothing worked 100%.

Thanks in advance.

-->

Iīm thinking, my problem is the htm file accessed by javascript link, itīs just one page... hat about creating a redirect for empty referrer only... so it would work only on that page! ... is it possible? I mean... redirect empty referrer to the same page as the javascript link is pointing?

[onlinemkt]

Interesting ... itīs working ok on Firefox but not on IE

[jdMorgan]

Did you completely flush your browser cache (Temporary Internet Files)?

Jim

[g1smd]

*** ErrorDocument 403 http://domain.net/index.html ***

That is bad on so many levels.

ErrorDocument directives must not include a domain name, just the local file path.

Serving the root index file in response to an error is highly NOT recommended.
Craft a custom error page instead.

Finally, when referring to the root of a site in a link, don't mention the index file filename itself.