1

I'm calling a server-side function written in PHP via wp-ajax. The server-side function eventually redirects to another page for an authentication step, and then redirects back to the initially shown page. For this to work in a generic way, I need to pass the URL from which the AJAX request was fired onto the server-side function. How can I actually do this?

When I try for example this, I get the link to wp-admin/admin-ajax.php...

I know that I could in theory use window.hrefor whatever in js and send that to the server, but I want to avoid this extra-piece of data sent, as I'm thinking that there must be some built-in wp feature for this...?

Improve this question
2
  • is this an AJAX request or are you sending the browser itself to admin-ajax.php? Is there a reason you used the old legacy API instead of the modern REST API?
    – Tom J Nowell ♦
    Commented Nov 26, 2021 at 17:14
  • Nope, it's an AJAX request; good old API. Mainly because the concerned page is written in vanilla js and wp-ajax only, no use of the REST API. Would of course be the next possible upgrade of the site, I agree with ya :P
    – DevelJoe
    Commented Nov 26, 2021 at 18:03

1 Answer 1

Reset to default
4

Ok got it, knew there must be some built-in WP solution to this. Simply call wp_get_referer() in your callback (for details, see this).

At least it's working as I need it, let me know if there's any better solution.

UPDATE

Thanks to @Tom J Nowell, we should also mention that referrers could get stripped for privacy reasons or similar. To thus be on the safe side, there's no way around passing the referrer's URL explicitely to the data sent across AJAX, like using document.location.href.

Improve this answer
6
  • referrers can't always be trusted, you can pass the URL explicitly when calling the function
    – Tom J Nowell ♦
    Commented Nov 26, 2021 at 17:14
  • You mean by using sth like document.location.href, I suppose? Thing is I thought that by using the default wp ajax hooks, action values, nonces and $_SESSION and $_POST checks, all done, it would be safe enough to simply ask for the referer, as the callback is only executed if all of these checkups are passed. That's the reason why I was looking for a server-side only solution; to get to the part of the server-side script needing the referer, you have to pass quite some security checkups already. What's your opinion on that?
    – DevelJoe
    Commented Nov 26, 2021 at 18:06
  • the problem is the referrer is untrustworthy, and it can get stripped out for security or privacy reasons, or mid-transit. Think of it more as a hint, it's better to just include the current URL as a parameter alongside the other parameters when making the request, then there is no doubt as to the originator
    – Tom J Nowell ♦
    Commented Nov 26, 2021 at 18:08
  • 1
    ah really, like in private browsing mode or some stuff, as for example safari does with the local storage in private browsing? ok now I get what u mean, gonna edit it then.
    – DevelJoe
    Commented Nov 26, 2021 at 18:10
  • 1
    exactly! I think that as a fallback the referrer could be a sensible heuristic, but if you can explicitly provide the value it removes much of the uncertainty and failure modes
    – Tom J Nowell ♦
    Commented Nov 26, 2021 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.