security - _Post from one site

[rickyj]

from a securit point of view how is it possible to make sure that any post data only comes from one site (that you define)

 

for instance if I had a example.MyRegistrationForm.php, which posts to example2.MyUserCreation.php

How could I make sure that the data is only posted from example.MyRegistrationForm.php

 

I dont want to send this in the post request (since post request can be manipulated), i need to find a way for  example2.MyUserCreation.php to know it come from example.MyRegistrationForm.php

 

Any ideas?

[per1os]

Use session variables or cookies.

 

It is not possible using referrer check due to the fact it is easily spoofed.

[cooldude832]

yeah best idea is some sort of psedo hash/baubblefish (hash is overkill but would be fun)

(this will sound overkill)

 

on example.php generate a random number (in what ever form you like)

Make a hash for 2 way encryption

store said vaule in a session called $_SESSION[$hashed] = $hashed;

make a hidden form var

<input type="hidden" name="hash" value="<?php echo $hashed;?>" /> (make sure to close for tiddyness)

 

then on the second page say (append if you use a 2 way encryption)

if($_POST['hash'] != $_SESSION[$_POST['hash'])

{//Wasn't coming from the right}

else

{//Have fun you know it processed via your form on your server}

 

 

note:

its safe to use this method because the sessions are stored server side.  Cookies could be modified, and if you really want to get secruity over kill md5 the random key a few times

for($i=0 $i<250; $i++)

{$hash =md5($hash);}

 

Overkill to the extreme

[Cathering_]

yeah best idea is some sort of psedo hash/baubblefish (hash is overkill but would be fun)

(this will sound overkill)

 

on example.php generate a random number (in what ever form you like)

Make a hash for 2 way encryption

store said vaule in a session called $_SESSION[$hashed] = $hashed;

make a hidden form var

<input type="hidden" name="hash" value="<?php echo $hashed;?>" /> (make sure to close for tiddyness)

 

then on the second page say (append if you use a 2 way encryption)

if($_POST['hash'] != $_SESSION[$_POST['hash'])

{//Wasn't coming from the right}

else

{//Have fun you know it processed via your form on your server}

 

 

note:

its safe to use this method because the sessions are stored server side.  Cookies could be modified, and if you really want to get secruity over kill md5 the random key a few times

for($i=0 $i<250; $i++)

{$hash =md5($hash);}

 

Overkill to the extreme

 

How fast will it do that at that rate but?

[cooldude832]

my method takes nothing at all (excluding the 250 ,md5() ) it just forces that random session to be registered you could even pull off a session ID in there, but this way you use a completely isolated unique value which is always a safe move.