C# Response.Redirect 去除 Header Referrer - 可以将其添加回来吗？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/243057/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Response.Redirect strips Header Referrer - Possible to Add it Back?
提问by Jeeby
I'm using a Response.Redirect to redirect users to another server to download a file, and the other server is checking the header to ensure it came from the correct server... however it seems Response.Redirect strips the headers from the Response.
我正在使用 Response.Redirect 将用户重定向到另一台服务器以下载文件，另一台服务器正在检查标头以确保它来自正确的服务器......但是似乎 Response.Redirect 从响应中去除标头.
Does anybody know how i can add the headers back? I've tried:
有人知道我如何添加标题吗？我试过了：
Response.AddHeader("Referer", "www.domain.com");
But the receiving page tests false when i check if the Referrer header is set.
但是当我检查是否设置了 Referrer 标头时，接收页面测试为 false。
Any suggestions how i can get this working, other than displaying a button for the user to click on (i'd like to keep the url hidden from the user as much as possible).
除了显示一个供用户点击的按钮之外，我还有什么建议可以让这个工作正常进行（我想尽可能地对用户隐藏 url）。
回答by tvanfosson
I don't think it's possible. What you are sending back to the client is a Location header that tells the client to load the page referred to instead of the page it originally requested. In this case the client is not coming from a link and thus does not set the referrer header. It's basically as if the user typed the redirect url in the location bar in his browser.
我不认为这是可能的。您发送回客户端的是一个 Location 标头，它告诉客户端加载引用的页面而不是它最初请求的页面。在这种情况下，客户端不是来自链接，因此不会设置引用标头。基本上就好像用户在浏览器的地址栏中输入了重定向 URL。
You may be able to save the referrer in the session, or encode it in the URL as a query parameter. Like the Forms login does with ReturnUrl.
您可以将引用者保存在会话中，或将其编码为 URL 中的查询参数。就像 Forms 登录对 ReturnUrl 所做的那样。
回答by Brian Schmitt
Is Server.Transferan option?
是Server.Transfer的一个选择吗？
There are some caveats though that you will need to look into. E.G. Keeps the original URL, Authorization, etc... More details in the link.
不过，您需要了解一些注意事项。EG 保留原始 URL、授权等...链接中的更多详细信息。
Keeping the original URL may be advantageous in this circumstance.
在这种情况下，保留原始 URL 可能是有利的。
回答by Martin Brown
The referrer Header that your second server gets is generated by the browser and it will be unlikely that you can change it in any sensible way.
您的第二个服务器获取的引用标头是由浏览器生成的，您不太可能以任何合理的方式更改它。
Did you try adding the Referrer to the URL and then reading that on your second server instead?
您是否尝试将 Referrer 添加到 URL，然后在您的第二台服务器上读取它？
Response.Redirect("url?Referer=" + Server.UrlEncode(Request.UrlReferrer));
回答by yfeldblum
Set an auth cookie (with a keyed hash and a 5-minute expiration), send a redirect response, browser sends a new request to the second server (if it's the same domain) along with the auth coookie, second server checks the cookie, ensures that only the first server could have set it, and sends back the content to the browser.
设置一个 auth cookie（带有密钥散列和 5 分钟到期），发送重定向响应，浏览器向第二个服务器（如果它是同一个域）发送一个新请求以及 auth cookie，第二个服务器检查 cookie，确保只有第一个服务器可以设置它，并将内容发送回浏览器。
回答by Leandro López
That will go against the Referer (sic) header definition:
这将违反 Referer (sic) 标头定义：
The Referer[sic] request-header field allows the client to specify, for the server's benefit, the address (URI) of the resource from which the Request-URI was obtained(the "referrer", although the header field is misspelled.)
Referer[sic] request-header 字段允许客户端为了服务器的利益指定获取请求 URI 的资源的地址 (URI)（“referrer”，尽管头字段拼写错误。）
If you are redirecting this is clearly not the case to add this header.
如果您正在重定向，这显然不是添加此标头的情况。
If you need this information try with a cookie or some session variable, or even better a variable in the URL as you have already been told.
如果您需要此信息，请尝试使用 cookie 或某些会话变量，或者更好的 URL 中的变量，正如您已经被告知的那样。
回答by Lazarus
If the redirect is to the same process I'd use a Session value to store the referrer URI to allow the secondary page to pick it up. I use that on my system to maintain the referrer between the redirect of http connections to our https system.
如果重定向到同一个进程，我会使用 Session 值来存储引用 URI 以允许辅助页面获取它。我在我的系统上使用它来维护 http 连接重定向到我们的 https 系统之间的引用。
回答by matt.mercieca
There is an HTML hack available.
有一个 HTML hack 可用。
<form action="http://url.goes.here" id="test" method="GET"></form>
<script type="text/javascript">
document.getElementById("test").submit();
</script>
If you need to trigger that from a code behind, that can be done too:
如果您需要从后面的代码触发它，也可以这样做：
Response.Write( @"<form action='http://url.goes.here' id='test' method='GET'></form>
<script type='text/javascript'>
document.getElementById('test').submit();
</script> ");
As Inkel might point out, that is a loose interpretation of the Referer[sic] spec. It will do what you want though.
正如 Inkel 可能指出的那样，这是对 Referer[sic] 规范的松散解释。不过它会做你想做的。
回答by Ben Scheirman
+1 to inkel's comment above.
+1 上面印克尔的评论。
Though if you don't care about the spec and just want to do it anyway, you can avoid using Response.Redirect and instead build the response headers yourself.
但是，如果您不关心规范并且只想这样做，则可以避免使用 Response.Redirect 而是自己构建响应标头。
Response.StatusCode = 302; //temp redirect
Response.Headers.Add("Location", "your/url/here");
Response.Headers.Add("Referer", "something.com");
Response.End();
This is off the top of my head, you might need to have a few other things in the response header.
这超出了我的想象，您可能需要在响应标头中包含其他一些内容。
回答by Makkie
Here is a version of previous that works for me:
这是对我有用的以前的版本：
default.asp
servername = Lcase(Request.ServerVariables("SERVER_NAME"))
Response.Status = "301 Moved Permanently"
Response.AddHeader "Location", "http://yoursite"
Response.AddHeader "Referer", servername
Response.End()
回答by user787262
I do not suggest to post - most websites block that.
just use javascript document.location = '<%:yourURL%>;';which will automatically load the new page. this is working well for me - because redirect response does not include referrer.
我不建议发布 - 大多数网站都会阻止。只需使用javascript document.location = '<%:yourURL%>;';它会自动加载新页面。这对我来说效果很好 - 因为重定向响应不包括引用者。
