prevent access to send request to a special script

user_1628474 0
Viewed 48

I write a simple php script that can calculate equal amount of a currency in other currency (for example BTC->DOGE) and because of changing price i have to update it dynamically (for example every 30 sec) so i used javascript with timer that periodically send ajax query to the php script and get the result...

but because of manage server load and usage of our bandwidth i want others can't use my script and prevent their request to run my script and only my site can run it. my question is how i can implement that?

i read about that use something like tokens in forms and set that in session and every time in the time of page creation token will be generated... but i don't know how to implement it in the javascript?

and also using check ORIGIN in $_HEADER ... but i heard (i don't know is correct or not) that everything in header is not reliable and can be fake

please help

thanks all

token php javascript
1 Answers

I understand what you're asking, and in short; it's not really possible, as that's how HTTP was designed. But you may mitigate the lousy attempts that attempt to do so; but not completely block it.

An option is to check the HTTP headers to validate that the request is coming from your site.

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(403);
    exit;
}
if (strpos($_SERVER['HTTP_REFERER'] ?? '', 'http://example.com') > 0 ) {
    // the request was NOT from my own site (http://example.com)
    http_response_code(403);
    exit;
}

For a more guaranteed block, implement MTCaptcha or reCAPTCHA. The solution above can easily be bypassed by a sophisticated hacker.

user_129896720
Related