alternative to HTTP_REFERER

[mufka]

I've been using HTTP_REFERER as a check to make sure that certain scripts are only run from certain other scripts. I've only used it in low impact or otherwise secured areas, but I need an alternative that I can use in public facing scripts. What options are there to make sure that a script cannot be run from unauthorized places?

 

[jpadie]

session variables.

 

[DonQuichote]

Let me elaborate on that. If you want a specific order in your pages (such as start with a login page), sessions are the way to go. But if you want to block a country for instance, there is no really reliable way to do that.

+++ Despite being wrong in every important aspect, that is a very good analogy +++
Hex (in Darwin's Watch)

 

[MichealC4]

You might want to look in to form tokens, as they are often used in conjunction with sessions to keep CSRF risks down. Think of it as an OTP for forms.

http://www.thespanner.co.uk/2007/04/12/one-time-form-tokens/

http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt