IFrame 引用问题 - asp.net c#
我们的一个应用程序将在 salesforce 内部的 iframe 中运行，但我在访问引荐来源网址时遇到了麻烦。他们希望我们进行一些引荐来源检查，以确保请求来自销售人员，并且我们已获得可供检查的 IP 地址。
我的问题是，每当我尝试通过以下两种方法之一访问引用者时：
HttpContext.Current.Request.ServerVariables["HTTP_REFERER"]
HttpContext.Current.Request.UrlReferrer
它都会返回 null。
我有什么想法如何才能获得推荐人吗？
PS：我知道您可以欺骗引用者，但这是要求的一部分。
One of our application will be run in an iframe, inside salesforce and I'm having troubles with accessing the referer. They'd like us to do some referer checks, to make sure the request is coming from salesforce and we've been given the IP addresses to check against.
My problem is that anytime I try to access the referer through either of the following two methods:
HttpContext.Current.Request.ServerVariables["HTTP_REFERER"]
HttpContext.Current.Request.UrlReferrer
it returns me null.
Any ideas how could I get hold of the referer?
PS: I'm aware that you can spoof the referer, but it's part of the requirement.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果我正确理解这个问题，您的客户端站点会通过在指向您站点的网页中嵌入 IFrame 来引用您的站点。您希望“确保”请求来自主机页面，该主机页面本身是指定站点集的一部分。指定站点集由一组 IP 地址来描述。这涵盖了吗？
棘手。首先，我们假设您有一个推荐人。您需要从中获取主机名（使用
Uri类型很容易）。然后，您需要使用 DNS 解析主机名的 IP 地址（对于 .NET 框架来说也不太困难）。当然，您需要获得推荐人，这是最棘手的一点。浏览器并不总是在请求中放置引用标头。当引用者地址与引用者不在同一域中时尤其如此，这里就是这种情况。 IOW，这是一个精彩。
解决此问题的更好方法（并且不易发生欺骗）是使用一些基于哈希的身份验证。不必太复杂（如果原始要求认为引用测试已经足够）。
If I understand the question correctly you have client sites that refer to your site by embedding IFrames in their webpages the point to your site. You wish to "ensure" that the requests are coming from host page which itself is part of a designated set of sites. The set of designated sites is described by a set of IP addresses. Does that cover it?
Tricky. First off lets assume you've got a referer. You will need to aquire the host name from it (easy enough using the
Uritype). Then you need to resolve the IP address for the host name using DNS (again not too difficult with .NET framework).Of course you need to get a referer and that is the trickiest bit. Browsers do not always place a referer header in the request. This is especially true when the referee address is not in the same domain as the referer, which is the case here. IOW, this is a showstopper.
A better approach to solving this problem (and is not prone to spoofing) is to use some hash based authentication. Doesn't have to be too sophisticated (if the original requirements felt the referer testing was sufficient anyway).
仅当通过链接请求页面时才会出现引荐来源网址。当从浏览器的地址栏中直接输入地址（或者在您的情况下设置 IFRAME 的 src）打开页面时，引荐来源网址将为空。
A referrer is only there if the page was requested through a link. When a page is opened say from the address bar in a browser by typing in the address directly (or in your case y setting the src. of the IFRAME), the referrer will be empty.