How to check a web page request came from user inbox

What you want is impossible.

Consider this situation: You email [email protected]. They can view the email via:

a) Desktop mail client
b) Smartphone/tablet mail client
c) Webmail

All three will appear "different" to your server, depending on exactly which client they clicked on your link in. And if the user forwards the email to someone else, say [email protected], the EXACT same link will be in that person's mail file as well, and they can view it via the exact same options.

You MIGHT be able to extract a username or some other personally identifiable datum from the refer IF they used webmail and the webmail system is stupid enough to have webmail.example.com/readmail?userid=someone

But otherwise, no, you cannot assume anything about the incoming click, only that SOMEONE clicked on the link in SOME email.

There is no way to tell if a link was opened from an email client or if it was pasted into the address bar. There is no way to track if an email has been forwarded (webbug images in an HTML formatted email are blocked by most email clients).

If you want to limit who can download the file from your servers, then require that users login and then hope that none of them engage is password sharing.

Even that won't stop them redistributing the file directly.

Its not really possible to "protect" a link.

But if your web application require user to login, you can generate a unique link for each of your user, and require him to login before allowing download.

People will be less prone to share their login/password than a simple url.

I know this is an old question and I'm not sure why it was down-voted, but an idea occurred to me. If you put a common pixel tracker in your email with a token that identified the user and the email edition which, when requested, your server would note the time the email was opened and read (and successive reads). Then if the user clicks the link in the email, a token on the link identifies the same user and email edition. When the server receives this request it could compare it to the last time the matching tracking pixel was accessed. If the pixel was accessed within a few minutes before the link was requested, that implies that the email was opened and then the link was clicked.

If the user book marks the link and uses it the next day, there would be no recent tracking pixel history, which implies that the request was not from the inbox.

This would be easy to spoof, so it shouldn't be used for any kind of security concern. You wouldn't know if the email was forwarded to another person. Their email client would hit the tracking pixel as well.

Many email clients would block the pixel tracking for ever-increasing privacy concerns, so it isn't reliable.

If you're just looking for an indication of usage, this might work.