如何确定用户是否来自https domian？

Question

I have a page that redirects users (JavaScript) to an "account admin" page (on an https domain) if the user is logged in. If not, the page shows them instructions on how to log in.

Once they're done updating their preferences, there's "back to content" link that takes the user back to the previous URL. The problem is that since users are logged in by this point, the redirect fires and sends them right back to their account admin page.

I thought I could determine this by looking at the referrer header from the https domain, but alas, they don't exist for https (as far as I can tell).

JSP:

    request.getHeader("referer");
    //returns null

I tried using JavaScript to dynamically append the URL with a parameter that I could then check for before firing the redirect again.

JavaScript

    window.location.pathname += "?test=1";

This causes a redirect loop, but I don't know of another way to modify the URL path.

Due to access limitations at work, I can't work in anything but my page template. I can't modify anything on the https server, nor htaccess.

So, with those limitations, how can I figure out if a user has come to my page from the https domain?

Answer 1

To get referring URL

document.referrer

If you are adding information to the URL that should not be sent to the server, but rather for the page to use, then use a hash, not a query. The "?" should only be used if you are sending data to the server for processing

window.location.hash += 'test=1'
//Makes the url look like http://example.com/#test=1

This Link will append "dontdoanything" to the url hash, without reloading the page.

EDIT : So I did some research and it doesn't seem like there is a quick way to do it (ie document.referrer ). But those methods are not very reliable anyway. I have heard that web-kit (may be older versions, and is fixed now) will drop the referrer information if the link is opened in a new tab or window, even for http to http.

It would seem that you are working completely on your own site, so I would consider using cookies or a hash in the URI. You could just set some variable within the cookie or hash when redirecting back and read it as a status flag when the page loads. You can of course have cookies persist for periods of time, as well as across all pages on your domain. There is a possibility that you already have session information stored in a cookie that you could even check.

If you were redirecting from pages not on your domain, I would suggest supplying those sites with a specific link, with a specific hash in the URI, that you can reference in your database to get the referrer.

Hope this helps...