Ignoring the merits of whether we should make this change or not (the circumstances are slightly complex and probably covered by my NDA), our client would like us to require that visitors to the site we're building have come from another of their sites. If a user comes to us from elsewhere, they should be sent to the login screen of that other site.
It feels like the easiest way to do this is using mod_rewrite
to redirect anything with a referrer that is neither our site nor this other one.
My current thinking is
In httpd.conf
RewriteMap deflector txt:/path/to/deflector.map
RewriteCond %{HTTP_REFERER} !=""
RewriteCond ${deflector:%{HTTP_REFERER}|NOT-FOUND} =NOT-FOUND
RewriteRule ^ http://www.theothersite.com/login.jsp [R=307,L]
In deflector.map
//www.oursite.com/ -
//oursite.com/ -
//www.theothersite.com/ -
//theothersite.com/ -
This would allow us to expand the list of "permissible referrers" quite easily, which feels like a good idea.
I have three questions then:
- Is
mod_rewrite
(which we're already using extensively) the best way of doing this? - If it is, then is a
307 Temporary Redirect
response the best way to handle it? - As I'm not primarily a LAMP dev / admin, have I made any stupid typos in those rewrite rules? ;o)
It feels to me that 307 Temporary Redirect
or 403 Forbidden
are the most appropriate status codes and I assume it's A Bad Thing™ to send a Location:
redirect header with a 4xx
response.
That all make sense?
Edit: Are the map searches case-insensitive by default? Do I need to worry about case here?
Edit 2: Are map searches a regex search or a whole-key match? If the map contains www.foo.com
and the Referer:
header reads http://www.foo.com/bar.php
will it match?
RewriteCond %{HTTP_REFERER} !=""
there first. And thanks, I didn't think I could send aLocation:
header with a4xx
code.