I guess that I'm sending a token to a web server, they use my token to redirect a user to my website and the user uses my website.

Now, using a WAF and setting x-forwarded-for I can get the IP of the user, but how can I confirm that the same web server has sent the user, not passing the token to another web server, and then the second server redirected the user to my website?

I want to be able to check if the user has come from the same server that I have sent the token for.


The HTTP Referer header is generally used to identify which website forwarded a client browser to the current site. It only reflects the last link in the chain.

However, as with anything submitted by the client, you cannot rely upon it for security purposes. It may not be included as a matter of browser policy, such as with Firefox Private Mode (but not Chrome Incognito). Non-private-mode browsers may still allow the user to turn it off via settings or via extensions.

It might be possible to have the other web server set something for you via CORS, but that presumes you'd be working pretty closely with them, which I don't get the sense of from your question.

Other than that, there's not much you can do. Your WAF will only see the connection from the client to you, and cannot know anything about previous connections the browser made.

  • Actually, we are in a position to enforce them to use/do whatever we want them to do. it's just how sure we can be that the request is being sent from themselves and not other website/service they are working with. Im going to search a bit on CORS to see what that is. thanks. – senaps Dec 29 '18 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.