Limiting access to a page

mrw2020

Hi everyone

I would like to limit access to a php page by url, for example if I wanted only 'www.mysite.com' to be able to access a certain page on 'www.mysecondsite.com' - is this at all possible and if so could someone point me in the right direction.

Many Thanks

Maddie

Styckyfinger

Hi Maddie,
I think what you need is $SERVER['HTTP_REFERER']
So it would be something like :
Site A points to site B
then on site B you would do something like
if ($SERVER['HTTP_REFERER'] == "www.mysite.com'"){
echo "content";
}else{
echo "no content";
}

If i understand your question correct.

bradgrafelman

Couple of things:

Limiting access and/or otherwise requiring HTTP_REFERER to be set is a Bad Idea (TM). For one, that is a client-provided header, meaning it can easily be faked/altered (there are even
plugins/mods that make this an easy one-click process).

For another, many browsers/anti-malware packages/proxies/gateways/whatever offer the ability to remove this header altogether.
'www.mysite.com' is not a URL (it's lacking a protocol identifier). Some clarification is needed to confirm whether you are indeed referring to URLs, domain names, subdomains, host names, ... ?

dagon

assuming http, passing a 'token' with the url from one site to the other is what i see used most often.

mrw2020

Thank you for your replies, forgive my ignorance but how does the http token work?

I would have preferred limiting access in another way but as the page doesn't require login or membership and not suitable for authentication in that way I'm not quite sure how it could be done. Does anyone have any ideas?

Any help would be greatly appreciated.

dagon

is the security concern is minor just add a string to the links between the 2 sites and check on site 2 that its the right one.

site2.com/foo.php?token=1223456

if you need something more create and store the token in a db that both sites can access and check it on site 2

dalecosp

As someone points out, your problem isn't state with the greatest amount of clarity 😉

For reference, I restrict some viewing to certain IP ranges by checking the value of HTTP['REMOTE_ADDR'], which is a little harder to fake, but still isn't perfect.

In this case, it also probably doesn't apply 😃 But, WTH. It might be useful to some Googler someday.

mrw2020

Thank you everyone for your help. I think I'm going to have to forget about trying to acheive this as it does seem a bit risky and open to errors, but it's made me re-think security issues.

Thanks again

kante

what about .htaccess?

isn't possible to write a rule such as...

if NOT www.allowedDNS.com and NOT MYIP Forbidden

if this is possible i'd like to have hint too about how to write such a rule...

thanks

mrw2020

That's a good point; sounds like an option I shall be trawling google now to try and find out!

Many thanks 🙂

dagon

that's no better than checking the $_SERVER['HTTP_REFERER'], with its limitation, what you need to understand its that http is a stateless protocol, every request is unique of itself and carries no record of the past.