referral locking

[BSDKing]

Was looking for a starting point on protecting our site.

What we need:

If someone comes to our site (directly, or by click) to force them to goto https://site.com/

UNLESS

The refurrel is from itself (site.com) or approved domains (subdomain.site.com, subdomain.site2.com)/IPs (10.1.1.1,5.5.5.1)

 

Make sense?

 

Thanks for helping out.

[dalecosp]

General redirect for HTTPS only:

if ($_SERVER['HTTPS']!="on") {
   header("location: https://site.com");
}

I am not a security expert; I don't know if this ($_SERVER['HTTPS']) can be faked.

For the rest, it's a tad more complex.  You would probably want an array of approved IP's, and an array of approved domains.  You could check the IPs with an in_array() call against $_SERVER['REMOTE_ADDR'].  Since they could be coming from a presumably large number of pages on the "approved sites" list, you'd probably need to loop through that array and do something like stristr() for each value (I'm hoping you don't have thousands of approved domains )

For those, you'd likely want to set a boolean variable for whether or not they would need to be redirected.

I do know enough about security to warn you on the IP's and "approved sites".  IP's can be spoofed, and $_SERVER['HTTP_REFERER'] should probably *not* be trusted, as it's fairly trivial to spoof and usually is where the bad guyz are concerned...

HTH,

Edited March 6, 2014 by dalecosp

[Psycho]

 

If someone comes to our site (directly, or by click) to force them to goto https://site.com/

 

Is your site the "site.com" in the example? So, what you are really saying, is if someone tries to access a page - other than the index - you want to verify their referrer status correct? If you were to include the index page then you could create an infinite loop (although the header redirect might solve that).

 

I will add the following to dalecosp's response:

 

You should store the white-listed value in a database. Much easier to do a SELECT query on a value (or partial value) than looping through an array. Plus, you will likely want to build the functionality to include sub-domains by default. So, you will pull the referred domain apart to just get the root domain and the TLD.

 

Plus, you should only run this logic the first time the user hits your site in a session. Once you have verified that they are allowed to navigate to other pages, then you should set a session value. Then, check that first on every page load. If OK, then continue on. If not, then use the logic to check the referrer.