Databases
StackOverflow2013
Postsdbo
POCan we ever determine if the request was sent from another domain?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POCan we ever determine if the request was sent from another domain?
    primarykey
    data
    text
    <p>I've read these webpages:<br> <a href="https://stackoverflow.com/questions/2841399/php-form-security-with-referer">PHP Form Security With Referer</a> and <a href="http://www.mustap.com/phpzone_post_62_how-to-bypass-the-referer-se" rel="nofollow noreferrer">http://www.mustap.com/phpzone_post_62_how-to-bypass-the-referer-se</a></p> <p>So basically my question is how do we determine for certain that the request was sent from our own domain? Or is there no way at all?</p> <p>(Question targeted at any server side language including but not limited to PHP/JSP/ASP.Net etc)</p> <p>My Problem: I have a page at <code>http://me.com/login</code> and on form submit, it will post to itself the login particulars. So far so good. until someone else can simply do this </p> <pre><code> &lt;form action="http://me.com/login"&gt; &lt;input name="password" value="p"&gt; &lt;input name="username" value="u"&gt; &lt;/form&gt; </code></pre> <p>and they can send a request to login to my application through their domain. I do not want this. I need a way to make sure that if my page receives a post, its from my domain. Else i will reject it.</p> <p>Besides, I'm abit shock when i read this: <code>There are plugins for Firefox that allow the user to specify whatever value they want to be supplied as the REFERER.</code> source: <a href="http://www.phpbuilder.com/board/showthread.php?t=10324100" rel="nofollow noreferrer">http://www.phpbuilder.com/board/showthread.php?t=10324100</a></p> <p>So we don't even need a hacker to break it now. Just about anyone could do it.</p> <p>I need a solution to make sure that i reject ALL requests not from my domain.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USCommunity
    1. USPacerier
    plurals
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. COWhat is the actual problem you are trying to solve?
      singulars
      1. POCan we ever determine if the request was sent from another domain?
      1. USMatthew
    2. COtag the request (url?) with some unique key you can check at the other end
      singulars
      1. POCan we ever determine if the request was sent from another domain?
      1. This table or related slice is empty.
    3. CO@konforce I'm trying to see how we could solve the issue at http://www.mustap.com/phpzone_post_62_how-to-bypass-the-referer-se
      singulars
      1. POCan we ever determine if the request was sent from another domain?
      1. USPacerier
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload