如何避免用户直接在浏览器中打开弹出窗口？

Question

On the click of the button, I am calling a javascript function which just opens a new window using following code.

window.open("mypopup_page.php", "_blank", "height=400, width=550, status=yes, toolbar=no, menubar=no, location=no, addressbar=no, top=200, left=300");

My problem is, even I have written location = no in window.open, user can see the url of the popup which he can copy paste into the addressbar of browser to open the popup directly. I don't want user to open the popup from the browser.

I am using .htaccess for redirection. For example to handle error 404, I have following code there:

ErrorDocument 404 /404.php

I want that, when the url contains mypopup_page.php file, .htaccess should redirect it to index.php so that user never be able to open it in the browser but only throught the popup.

Is there any way to do so through .htaccess file or is there any easier way to achieve my task?

Answer 1

the simplest way is to use PHP and check $_SERVER['HTTP_REFERER']. If the referrer is not an address you want them to be coming from, eg, directly linking from browser, you can redirect them else where, or do whatever you want.

EXAMPLE: mypopup_page.php

<?php
$target_url = "http://" . $_SERVER['SERVER_NAME']; //this returns 'myexample.com'

//comparing the two variables. I'm using strpos here, but you can compare it in any way you want.
if(strpos($_SERVER['HTTP_REFERER'], $target_url) !== FALSE) {
  //all is good
} else {
  header("Location: http://google.com"); //redirecting here, but it can be anything
}