How can I prevent the direct call of an URL in an ASP.NET / IIS environment?

Question

How can I achieve in an ASP.NET application, that a set of URLs/ASPX pages (parts of the application) cannot be called directly from the user in the Browser? These urls/pages may only be referenced in the application itself.

Answer 1

You can't. If a user can get to a page, they will be able to call it directly. You can't control peoples browsers...

One option is to look at the "HTTP_REFERER" header and if it is empty or has an unexpected value redirect. This does mean that your application will have to set it.

Another one is to create a custom header ("X-my-app", for instance) and if it does not exist, redirect.