I would like to put a link back to my site on other "approved" domains. When they click on the link it goes to a page that checks the referrer ($_SERVER['HTTP_REFERRER']) to make sure they came from a domain that is approved to have my link. This can be spoofed so how can I make sure the clicks are actually coming from the approved domains?
views:
98answers:
1
+3
Q:
PHP referrer: How to make sure a request is actually coming from where it's supposed to come from.
+8
A:
You can't do it. You can't prevent the referrer from being tempered with.
An alternative would be possible if there's collaboration between the several sites. For instance, the links in the other sites to yours could pass a token as a parameter in the URL that would be usable only once and which you could then validate.
Several validation strategies would be possible. Your site could contact the other site and ask it if the passed token is valid or you could employ a signature with the token acting as a nonce so you didn't have to contact the other site.
Artefacto
2010-07-25 18:04:22
Wrikken
2010-07-25 18:06:42
Nick
2010-07-25 18:15:18
Using a timestamp based nonce is a good strategy because you don't need to store all the nonces you have ever seen to deny them in the future. You could only store those seen in e.g. the last say 3 hours and reject all that are older. If can live with some reused tokens in a small timespan you could even store nothing at all.
Artefacto
2010-07-25 18:23:13
What's this nonce stuff all about?
John
2010-07-25 19:45:47
@John See http://en.wikipedia.org/wiki/Cryptographic_nonce
Artefacto
2010-07-25 19:48:26
John
2010-07-25 19:56:50
@John It's the client that claims he comes from a certain website, the website only certifies that what the client says is true. Sure, the other websites could make public the secret they use to generate the links, but you have no way to control that.
Artefacto
2010-07-25 20:07:01
@artefacto, thanks again for clarifying. so is there any way to make this work?
John
2010-07-25 22:43:31
@John Since the only way is to add some parameters to the link and the link is shown by the other sites, there's no way to protect yourself against rough sites that leak the link generating secret.
Artefacto
2010-07-25 22:59:21
well how does google adsense or the google maps http api work, more specifically how does the maps api enforce a limit on requests if the IP can be spoofed?
John
2010-07-26 00:06:08
@John An IP cannot be spoofed (over the Internet).
Artefacto
2010-07-26 00:13:10
Ok, well if the only variable I have to check for is $_SERVER['REMOTE_ADDR'], what can I do to check for the real IP?
John
2010-07-26 00:38:52