Re: [Lynx-dev] HTTP Referer Error

[Thomas Dickey]

On Sun, Mar 23, 2025 at 12:39:45PM +0000, Vincent via Lynx-dev wrote:
> Dear Developer,
> as I could not find (fitting) existing information on this issue, l feel
> inclined to contact you. 
> I am trying to set up the eduVPN client on my system running the latest arch
> release (2025.03.01) in the latest available version of lynx browser (2.9.2). 
> The guide I follow
> (https://doku.lrz.de/vpn-eduvpn-konfiguration-fuer-tum-11497326.html) shows
> configuration through a GUI, however, this can also be done in bash. 
> Eventually, the configuration continues in the browser (eduVPN client
> automatically opens
> https://tum.eduvpn.lrz.de/vpn-user-portal/oauth/authorize?client_id=org.eduvpn.app.linux&code_challenge=sETq8mEq5Ka_AM6duM18Z1n4Jc2X5TAreG67ltza4tE&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A35567%2Fcallback&response_type=code&scope=config&state=8w8TDGiPh1xEsH8kJvPJIunwhrl-OEY3muiQCC1ZHwk
> in lynx at this point).  The login via my institution (Technical University
> of Munich) works flawlessly in lynx, however, once I arrive on the last step,
> i.e. allowing the VPN connection on the eduVPN website, I get a HTTP 400 Bad
> Request error.  Furthermore, I get forwarded to an error page, showing the
> error massage "missing HTTP_REFERER".
> After searching the Internet for this issue, I changed the following
> parameters in "lynx.cfg": 
> NO_FROM_HEADER:FALSE,
> NO_FILE_REFERER:FALSE,
> REFERER_WITH_QUERY:SEND.
> Furthermore, I feel like I should mention that NO_REFERER_HEADER is set to
> FALSE.
> Sadly, this did not fix the issue I am having, hence my message.  Do you have
> any idea how this issue may be resolved?  Is there any documentation or forum
> discussions I missed?

no - it's been a while since there's been any discussion of HTTP REFERER
on this list - see

https://lists.nongnu.org/archive/cgi-bin/namazu.cgi?query=referer&submit=Search%21&idxname=lynx-dev&max=20&result=normal&sort=score

A google search on the topic gives some general advice:

        A "400 Bad Request" error, often related to the HTTP Referer header,
        signifies that the server cannot process the request due to a
        client-side issue, such as an invalid URL, incorrect request format, or
        potentially a problem with the Referer header itself. 

        Here's a breakdown of potential causes and solutions:

        Possible Causes:

        Invalid URL or Request Format:  The URL you entered might be incorrect,
        or the request itself might be malformed. 

        Outdated Cache or Cookies:  Stale browser cache or cookies can
        sometimes interfere with requests. 

        Browser Extensions:  Certain extensions can cause issues with web
        requests. 

        DNS Issues:  Problems with your DNS resolution can lead to incorrect
        server addresses. 

        Large Request/Cookie/Header:  The request, including the Referer
        header, or cookies, might be too large for the server to handle. 

        Server-Side Configuration:  The server might have a configuration issue
        or a firewall that is blocking the request. 

        Incorrect Authentication:  If the API requires authentication, sending
        a request without proper credentials or with incorrect credentials can
        lead to a "400 Bad Request" error. 

You might get some insight by running lynx with its trace enabled, to see
if there's something that goes awry with the URL.

Seeing that the URL comes in with %-encoding, for instance, it could be
mangled if it is transformed a second time.

> Thank you for your time, I really enjoy using lynx.
> 
> Yours Sincerely 
> Vince
> 
> 

-- 
Thomas E. Dickey <dickey@invisible-island.net>
https://invisible-island.net

signature.asc
Description: PGP signature