Forum Discussion
hooleylist
Dec 02, 2011Cirrostratus
I don't think a browser will set a Referer header when transitioning from an HTTPS site to an HTTP site:
http://tools.ietf.org/html/rfc2616section-15.1.3
Clients SHOULD NOT include a Referer header field in a (non-secure)
HTTP request if the referring page was transferred with a secure
protocol.
And the referer header can easily be spoofed, so using it for authorization isn't a secure method.
If the two FQDNs are on the same domain, you could try setting a session cookie on the HTTPS virtual server and store that in a subtable. Then when a request is made to the HTTP virtual server, you could look for the cookie and check it against the subtable entries.
Aaron