Question about $_SERVER['HTTP_REFERER']

[jeremyapp]

Hi,

 

I work for a publishing company that recently started selling their print books in an eBook format - I've been working on the system to control access.

 

When a customer buys an eBook, they get a link to it, which points to the following php script:

 

http://www.domain.com/viewebook.php?code=(viewing code)&book=(book id)

 

This script checks the code against the database to ensure that it is valid and current, and then checks to see whether the user has purchased access to the specific book id.  If that check is successful, it uses the following code to redirect the user to their eBook (with some pseudo-php to conserve your time):

 

(Code to check for validity)

(if valid)
header("Location: http://www.domain.com/eBooks/$bookname/Default.php?lang=$lang");

 

The obvious problem with this is that this eBook page, "Default.php", can be accessed directly, and is shown clearly in the address bar once the redirect has taken place.  Although I know this isn't ideal, I would like to use the $_SERVER['HTTP_REFERER'] variable to ensure that the user came from the viewebook.php file.  Before you tell me how the referrer is easily spoofed, security is not a huge issue here, and this is only a temporary solution.  However, it seems that this won't work, because the referrer appears to be the page on which the user clicked the link to viewebook.php link, and not the viewebook.php file itself.  Since the book will be linked from multiple places, this won't do.  Is there something else I can do? 

 

Thanks.

 

[GingerRobot]

So the user has to login to view the ebook? Can't you just check the user is logged in and has bought the ebook on default.php?

[jeremyapp]

The trouble is the viewebook.php file is so closely tied in with the current system that it would be easier to design a solution that works with it.

 

Here's an idea, but I'm not quite sure how to make it work.

 

Could I do something like this?

 

(if valid)
$_SESSION['ok_to_view'] = true;
header("Location: http://www.domain.com/eBooks/$bookname/Default.php?lang=$lang");

 

And then have Default.php do this: (sorry in advance about the lack of indentation, I couldn't figure out how to add them in this thing!)

if(!$_SESSION['ok_to_view'] == true) {

echo "error";

} else {

(display eBook)

}

 

The trouble with this, though, is doesn't the session end once the redirect occurs?  Something isn't working, because that code doesn't work as-is.

 

Jeremy

[GingerRobot]

The trouble with this, though, is doesn't the session end once the redirect occurs?

 

No; that's the whole point of sessions. Perhaps reading this tutorial might help your understanding there.

 

As for non-working code; it generally helps if you post your actual code

[jeremyapp]

To follow up, I was able to make it work by putting an @ sign in front of the session_start(); to suppress an error it was giving me about the session.  I know it's sloppy but I couldn't figure out what I was doing wrong and this seems to work fine - it said something about the header already being sent (I'd give you the error but I'm not at my work computer).

[GingerRobot]

That occurs because you're trying to set a session after data has been sent to the browser. Move the call to session_start() to the top of the script, above any output -- including whitespace.

[jeremyapp]

I think the issue has to do with whitespace - it is at the top, but there might be a gap (I'll check when I get back).  If it is just an issue with whitespace, is it okay to just suppress the error, or will I run into problems?

[PFMaBiSmAd]

Suppressing an error message stating that something is not working does not make it start working.

 

Posting your actual error message will get the quickest solution.

 

A redirect is performed by the browser. As long as the session worked on one page and the session id is sent from the browser to the server (assuming that the host and path settings for the session cookie match the new page) when the URL of the new page is requested, then a session will work on the page that gets redirected to.

[jeremyapp]

Suppressing the error did make it work in this case.  I'll post the error message later to clear everything up but it seems the script stopped executing when I tried to open the session, while suppressing that error let everything work.  My guess is this is a whitespace issue as was described before.

[PFMaBiSmAd]

Suppressing the error might have allowed the redirect to work, but any usage of a session on that page won't be working (and if you there are no references to session variables on that page, there is no need for a session start.)

[jeremyapp]

Here's a snippet from viewebook.php (sorry about the pseudo-php, I'm doing this off the top of my head):

 

<?php
session_start();

if(license is valid) {

$_SESSION['ok_to_view'] = true;
header("Location: http://www.domain.com/eBooks/Default.php?lang=English");
exit;

} else {

header("Location: http://www.domain.com/eBooks/error");

}

?>

 

Here's the code from Default.php:

 

<?php
session_start();

if($_SESSION['ok_to_view'] != true) {
echo "Authentication Error";

} else {

(code for the eBook)

}

?>

 

I still don't have the error message on me, but is there anything that would cause an error here?

 

 

[jeremyapp]

I should point out, also, that this does work if i use an @ in front of session_start(); in Default.php.  If I don't - I can't remember for sure what the message is, but it says something about the header already being sent.

[jeremyapp]

anyone?

[DarkWater]

It doesn't work with the @, it just doesn't error you out because of the @.  session_start() needs to be at the top of the page that you want sessions on, or before ANY output from the script.  I'd recommend the former.

[jeremyapp]

do I not need the session_start() in my second script then, even if I'm referring to a $_SESSION variable?  I can't seem to find any reason that the code I posted wouldn't work.

[GingerRobot]

do I not need the session_start() in my second script then, even if I'm referring to a $_SESSION variable? I can't seem to find any reason that the code I posted wouldn't work.

 

How about because you've not posted the code you are using? Do you seriously expect us to find an error in your code if you post something you 'made up in your head'?