referrer from an e-mail?

[Dan99]

Here's a probably crazy idea. I would like to regulate access to my website on the basis of referral ID. No problem if that referral is from a website, but what if it's from an e-mail? When an active link is posted in an e-mail, and you click on that link, no referrer is transmitted. I'd really like to find a way to have a web page be accessible to only those who click on a link in an e-mail I send them.

I guess this would mean that the e-mail reader application would need to transmit a HTTP_REFERRER ID to the browser that asks for the web page, but I don't know if that's possible.

[lucy24]

but I don't know if that's possible

Well, it certainly isn't possible in other people's software. That includes email you send-- unless you've got your own proprietary email program.

Why don't you append something like a special parameter to links you send out?
http://www.example.com/directory/this-fantastic-page.html?source=myemail
Then you can deny access to any requests that don't contain the parameter "source". The parameter itself doesn't have to do anything; it just has to exist. You can do this either in mod_rewrite or with the mod_setenvif + mod_auththingummy combo, whichever is more convenient.

[Dan99]

That is a remarkable solution. Thanks. So I can append to the link some key text field preceded by a "?", the page will load properly *and* the whole link, including the key text field, will appear in my log, where I can apply a filter to it in my .htaccess? That's pretty cool.

[phranque]

When an active link is posted in an e-mail, and you click on that link, no referrer is transmitted.

if the visitor is using an email client you typically won't get a Referer header with the request, but if the visitor is using a webmail application on a browser then the Referer may be sent.

So I can append to the link some key text field preceded by a "?"

this part of the url is called a query string.

the page will load properly

that depends on your server's response and your definition of "properly".

*and* the whole link, including the key text field, will appear in my log

yes the query string is logged with the requested path.

where I can apply a filter to it in my .htaccess?

i'm not sure what you mean by "filter" and you can't do much log filtering in .htaccess but you can certainly examine the requested query string in .htaccess using mod_rewrite directives (RewriteCond).

[Dan99]

Yes, I wasn't clear. By "filtering", I meant that my .htaccess could use a mod_rewrite directive to act on the request selectively.

I tried the query string on my server, and it works. So I think I'm good to go.

That a visitor using webmail on a browser may send a Referer when a link in an e-mail message is clicked on is interesting. I need to check that out.

This is really pretty slick. It means that the link (wherever it is) can carry an ID that is transferred to the server.

[lucy24]

So I can append to the link some key text field

This sounds alarming. How big is the "key text field"? There's a limit to the length of a query string, though admittedly the limit is pretty vast.

You can also include a # fragment identifier in your clickable link. This will not be sent back to your server, but may be useful if you want your visitors to arrive at a particular part of the page.

[Dan99]

No, not so alarming. By "key test field" I just mean a unique identifier. As in http://www.example.com/frontpage.html?xyz123.

I like this because, for requests from a client that doesn't transmit a Referer, I can track where the requests are coming from. Like when I e-mail a link to lots of people, I can add a unique query string to that link that says it came from that particular e-mail.

As to webmail on a browser, I note that gmail, at least, doesn't send a Referer.

[edited by: phranque at 6:33 am (utc) on Jan 30, 2015]
[edit reason] Please Use example.com [webmasterworld.com] [/edit]

[Dan99]

OK, I'm beginning to understand this query string business. I notice that in many forums (although evidently not in Webmaster World), the link to a forum post looks like this

http://www.example.com/forum/index.php?topic=28481.160

So this is where the forum doesn't want to allocate a specific URL to the post publicly, but just says, "tell me what post you want to see in your query string, and I'll figure out where to send you". Is that how it works?

[lucy24]

A query string is part of the URL. If you want to break it up, there are four pieces:

protocol (followed by ://): http or https
host: example.com
path: directory/subdirectory/filename.xtn
query (preceded by ? question mark): source=this&page=that, where each piece of a multi-part query ("parameter") is delimited by & ampersand

A browser may also get one further bit of the address:

fragment (preceded by #): in-page link identified by "name" on an <a> element and/or "id" on any element.

Don't confuse the query-- which is part of the URL-- with the fragment-- which is not.

The body of a RewriteRule looks primarily at the "path". If you want to look at any other part of the URL-- protocol, host, query-- each of those requires a RewriteCond. There is no way to look at the fragment, because that isn't sent by the browser to the server. (It can be sent from the server to the browser, but that's unrelated.)

Ordinarily each parameter will be in the form
paramname=paramvalue
but it doesn't have to. You can give a paramname by itself, or have nothing after the = sign.

For your purposes, it will be most useful to pick some name and reuse it, assigning different values for your own benefit.
Check whether a query string exists at all:
RewriteCond %{QUERY_STRING} .
Check whether parameter "thisname" is present:
RewriteCond %{QUERY_STRING} thisname
Check whether parameter "thisname" has value "23":
RewriteCond %{QUERY_STRING} thisname=23

There are further complications and nuances, but that's your starting point.

[Dan99]

That's helpful. Thanks. So QUERY_STRING is actually a server variable for RewriteCond. That's how I use it in my mod_rewrite directives.