Trying to pevent POST spoofing

[barrax]

I'm basically trying to stop people from posting information to my php file from another domain. The script i have so far is below. Whats happening now is that no information is getting through at all. I suspect it's something to do with the positioning of the "die()" function; (i have other lines of code under these lines which i need to execute).

Can someone please correct me on this.

//GET THE HOSTNAME VALUE
$ref = $_SERVER['HTTP_REFERER'];
preg_match("/^(http:\/\/)?([^\/]+)/i",
   $ref, $matches);
$host = $matches[2];


//CHECK ITS POSTED FROM THE CORRECT LOCATION
echo "referer=$host&";
if($host=="www.myActualDomain.com"){
 echo "valid=1";
}else{
 echo "valid=0";
 die("you are trying to submit information from an invalid location.");
}

By the way i tried this to try and combat the problem...

 
ini_set("allow_url_fopen", "off");

This seemed to switch off the allow fpoen stuff in the phpinfo() window but didnt stop people from submitting from elsewhere 🙁

[suntra]

Maybe another solution...

If you post information to one of your script, maybe before posting, you could write a (unique) key in a file or DB and send that key with the information. Then, in the script receiving the posted information, you look if the key exists (in the file or D😎 AND YOU DELETE IT (it will prevent other people from copying that key and use it all the time).

[LordShryku]

The key idea is good. I'd create a session and pass it through there.

[suntra]

I would simply pass it through the form in a hidden input.

[LordShryku]

That can still be spoofed. Sure, they'd need to figure out your encyption method, but some people are just bored enough to do that.

[suntra]

Of course they could open the form page and look what is the key. You brought a good point! But if we open a session or send a cookie, it can also be spoofed. To come back to the key in the form, I would put a non-encrypted key in the form, but in the file OR db, it would be md5. It is supposed to be impossible to decrypt... Also, I would put the IP of the person and her browser name and check them when the form is posted...

[adnan1983]

HTTP_REFER, doesn't work all the time. So, session id would be the best idea.