Cross site validation token exchange validation ASP.Net

Question

0.00/5 (No votes)

See more:

I have got a web site say "www.abc.com". I am providing a link (www.abc.com/marketingpage.aspx) to another web site "www.xyz.com" to display my page in a iframe in their site. In the www.abc.com/marketingpage.aspx there is link to www.abc.com/registration.aspx page. Is there any way to find whether the user is coming to my www.abc.com/registration.aspx page from the www.xyz.com site and not directly through URL.

Posted 18-Sep-12 3:00am

Roshin Narikkot

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Ashraff Ali Wahab · Answer 1 · 2012-09-18T05:10:00

Solution 1

SQL

Why dont you put a Query string as a uniqueId in www.abc.com/marketingpage.aspx?QS=3F2504E0-4F89-11D3-9A0C-0305E82C3301 and give the URL to www.xyz.com.

By this way you identify the site it is coming from.You have to map 3F2504E0-4F89-11D3-9A0C-0305E82C3301 to www.xyz.com

Posted 18-Sep-12 5:10am

Ashraff Ali Wahab

Comments

Roshin Narikkot 18-Sep-12 11:58am

I accept the solution, but I dont want any other user to reuse the query string. (If any out side user take the URL and paste it on the Browser address bar). What I need is to confirm the previous page to the www.abc.com/registration.aspx page is a page from the www.xyz.com site.

Ashraff Ali Wahab 18-Sep-12 14:10pm

Unless both abc.com and xyz.com share the same authentication model or atleast federated authentication,it will be virtually impossible to identify the source apart from the querystring.