0

I'm calling a server-side function written in PHP via wp-ajax. The server-side function eventually redirects to another page for an authentication step, and then redirects back to the initially shown page. For this to work in a generic way, I need to pass the URL from which the AJAX request was fired onto the server-side function. How can I actually do this?

When I try for example this, I get the link to wp-admin/admin-ajax.php...

I know that I could in theory use window.hrefor whatever in js and send that to the server, but I want to avoid this extra-piece of data sent, as I'm thinking that there must be some built-in wp feature for this...?

2
  • is this an AJAX request or are you sending the browser itself to admin-ajax.php? Is there a reason you used the old legacy API instead of the modern REST API?
    – Tom J Nowell
    Nov 26 '21 at 17:14
  • Nope, it's an AJAX request; good old API. Mainly because the concerned page is written in vanilla js and wp-ajax only, no use of the REST API. Would of course be the next possible upgrade of the site, I agree with ya :P
    – DevelJoe
    Nov 26 '21 at 18:03
1

Ok got it, knew there must be some built-in WP solution to this. Simply call wp_get_referer() in your callback (for details, see this).

At least it's working as I need it, let me know if there's any better solution.

UPDATE

Thanks to @Tom J Nowell, we should also mention that referrers could get stripped for privacy reasons or similar. To thus be on the safe side, there's no way around passing the referrer's URL explicitely to the data sent across AJAX, like using document.location.href.

6
  • referrers can't always be trusted, you can pass the URL explicitly when calling the function
    – Tom J Nowell
    Nov 26 '21 at 17:14
  • You mean by using sth like document.location.href, I suppose? Thing is I thought that by using the default wp ajax hooks, action values, nonces and $_SESSION and $_POST checks, all done, it would be safe enough to simply ask for the referer, as the callback is only executed if all of these checkups are passed. That's the reason why I was looking for a server-side only solution; to get to the part of the server-side script needing the referer, you have to pass quite some security checkups already. What's your opinion on that?
    – DevelJoe
    Nov 26 '21 at 18:06
  • the problem is the referrer is untrustworthy, and it can get stripped out for security or privacy reasons, or mid-transit. Think of it more as a hint, it's better to just include the current URL as a parameter alongside the other parameters when making the request, then there is no doubt as to the originator
    – Tom J Nowell
    Nov 26 '21 at 18:08
  • 1
    ah really, like in private browsing mode or some stuff, as for example safari does with the local storage in private browsing? ok now I get what u mean, gonna edit it then.
    – DevelJoe
    Nov 26 '21 at 18:10
  • 1
    exactly! I think that as a fallback the referrer could be a sensible heuristic, but if you can explicitly provide the value it removes much of the uncertainty and failure modes
    – Tom J Nowell
    Nov 26 '21 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.