check-referrer

middleware for routing requests based on referrer

npm install check-referrer

checkReferrer

Params:

• rules String

  list of routing rules

  • - means exclude from redirect
  • + means only exclude from redirect

• redirect String

  route for redirect

req.fromAllowedReferrer will be set to true for whitelisted referrers

examples

By default, all requests are redirected.

To exclude urls from redirection use '-'

// Whitelist requests from example.com
var checkReferrer = require('check-referrer');
app.use(checkReferrer('-example.com'));
// req.fromAllowedReferrer will be set to true in all middleware that runs after a request from example.com

// Only allow and whitelist requests from example.com
var checkReferrer = require('check-referrer');
app.use(checkReferrer('-example.com', '/redirect-here'));

To redirect only specific urls while allowing all others, use '+'

// Only redirect requests from example.com
var checkReferrer = require('check-referrer');
app.use(checkReferrer('+example.com', '/redirect-here'));

Seperate rules with a comma

// Only allow requests from certain domains
var checkReferrer = require('check-referrer');
app.use(checkReferrer('-example.com,-mysite.com,-othersite.com', '/redirect-here'));

The rule doesn't have to be a url

// Only allow visitors with a secret referrer key
var checkReferrer = require('check-referrer');
app.use(checkReferrer('-my_secret_key', '/redirect-here'));

caveats

This is "security" by obscurity, similar to passwords. If somone knows your password, then its useless. Likewise, if the visitor knows which referrers are allowed, they can easily spoof their referrer.