Need To Prevent Script from being ran from Address Bar

[progressivebiz]

I am on an Apache Server running Perl 5.xx and I would like a method to prevent people from simply running the script from the address bar.

The only way I want to run the script is after they purchase a product (which would be coming from a different secure site), or sign in as a member (locally on the server), clicking a link(from anywhere), etc.

I am not new to HTML or programming logic, just Perl, and WebScripting...So any help would be appreciated...

Both from a 'https' secure server so I am unable to use 'document.referrer'...I want the customer to not be bothered with intrusive tactics just to use my services.

Chris B.

[edited by: jatar_k at 4:01 pm (utc) on Aug. 16, 2004]
[edit reason] no sigs thanks [/edit]

[Bluepixel]

-If they buy the software, set a cookie, and if they execute the script, check if they have that cookie
-Or execute the script through the script where they buy your software.
.etc....

[volatilegx]

Another way to do it would be to have the script accept only POST requests, instead of GET requests. When you type a URL into the address bar, a GET request is used. A POST request is used, for example, in most form submissions.

You can make a link use a POST request with a little creative JavaScript, by setting up a form and having the link activate a JavaScript function that submits the form to your script.

Sample Perl code:

[pre]
if ($ENV{'REQUEST_METHOD'} ne 'POST') {
 print 'Content-type: text/html\n\n';
 print 'Access Denied';
 exit;
}
[/pre]

[kalos]

Your best bet is a combination of the cookie response and a check for only POSTs. I would go a step further and write a unique session ID to a database or flatfile with the user's name or id as an identifier and verify against that for added security.