how can I reliably check that requests to my service file have come from my website?
- by woot586
I have a service.php class that I use to service AJAX calls from my website. To prevent other people accessing the service using PHP CURL I would normally check the request has come from mysite, and if they are not then just redirect to my home page e.g.
if($_SERVER['HTTP_REFERER'] != "http://www.mysite.com"){
header('location: http://www.mysite.com');
exit;
}
I read in the PHP holy bible:
http://www.php.net/manual/en/reserved.variables.server.php
that
"Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted."
So if this method is not reliable, my question is how can I reliably check that requests to my service file have come from my website?
Thanks for any help you can provide!
