how to make sure POST data comes from specific domain?

Question

I have a page confirm_payment.php receiving POST data from other pages. How can I make sure this POST data comes only from one specific domain?

I cannot rely on IP addresses as in my case this might change. I want to avoid "fake" submissions to my confirm_payment.php server side code.

Without going into details this is to make sure that my page receives confirmation from payment gateway hosted page and confirmation is genuine.

Answer 1

John Conde had a great explanation on how to solve your problem at: http://stackoverflow.com/questions/3251293/sending-data-to-payment-gateway-and-back-possible-problems/3255907#3255907

If you need more information, please go back to your original question.

Answer 2

You should have your server generate a nonce (number used once) that gets posted, and validated (since your server generated this number it can determine genuine posts)