如何确定在调用动态javascript文件的页面与ASP.net中的用户之间

Question

I'm making use of dynamic JavaScript files that are generated in asp.net and then embedded as a normal javascript in an html page. Is there a way for me to determine if the dynamic javascript was opened directly or via the embedded script in the html page?

<script src="http://localhost:60919/js.ashx" type="text/javascript" charset="utf-8"></script>

Answer 1

If this was called from the web page, you should see the loading page listed in the referer property.

context.Request.UrlReferrer

OR

context.Request.ServerVariables["HTTP_REFERER"]

This should be null if loaded directly by the user. However, a spammer/hacker can manually set the referer to gain access to the script independently of your page.

UPDATED: Handler.ashx:

<%@ WebHandler Language="C#" Class="Handler" %>

using System;
using System.Web;

public class Handler : IHttpHandler {

    public void ProcessRequest (HttpContext context) {
        context.Response.ContentType = "text/javascript";
        context.Response.Write("alert('"+context.Request.UrlReferrer+"');\n");
    }

    public bool IsReusable {
        get {
            return false;
        }
    }

}

Default.aspx:

<%@ Page Title="Home Page" Language="C#" MasterPageFile="~/Site.master" AutoEventWireup="true"
    CodeFile="Default.aspx.cs" Inherits="_Default" %>

<asp:Content ID="HeaderContent" runat="server" ContentPlaceHolderID="HeadContent">
</asp:Content>
<asp:Content ID="BodyContent" runat="server" ContentPlaceHolderID="MainContent">
    <script src="Handler.ashx"></script>
    <h2>
        Welcome to ASP.NET!
    </h2>
    <p>
        To learn more about ASP.NET visit <a href="http://www.asp.net" title="ASP.NET Website">www.asp.net</a>.
    </p>
    <p>
        You can also find <a href="http://go.microsoft.com/fwlink/?LinkID=152368&amp;clcid=0x409"
            title="MSDN ASP.NET Docs">documentation on ASP.NET at MSDN</a>.
    </p>
</asp:Content>

Alert shows http://localhost:port/Default.aspx when loaded by the web page. When accessed directly, alert('').