嵌入式iframe - 验证GET请求的来源/来源

Question

I'm seeking to utilize an iframe to embed some html in customers websites that will list some information from my database using a simple GET request like so:

// customer would copy/paste this code onto their site
// value of key would be unique key for that customer

<iframe src='http://mydomain.php/api?key=1234j1lj1hj124kh' ></iframe>

Now I want to be able to verify that the request is coming from customer that owns the key, and not just anybody who copy/pasted that code onto their page.

I've done some research and found that $_SERVER['HTTP_REFERRER'] can give me this information, but with mostly mixed reviews saying it isn't always reliable (and most of the questions I came across were a couple years old).

QUESTIONS

1.) Is this method of using an iframe/GET request the standard way of achieving this functionality?

2.) Is there a standard, SECURE and RELIABLE way to verify the origin of the GET request?

Answer 1

Unfortunately this is not possible in a secure way.

To answer your questions: In fact this is not a standard functionality itself. I mean, there is no standard secure way of allowing content to be loaded only through iframes from allowed websites.

There are three parties in this communication:

1) Your website

2) Customer website that loads your website's data in an iframe

3) End user visiting customer website

When an end user visits customer web site, he will perform a GET request to your website through the iframe. At this connection, 2nd party above (customer website) is not involved. In this case, there is no reliable way for your website to know whether this request is coming through the iframe or not. Only favor that party 2 does here is adding HTTP_REFERER header to end-user's request. But this header cannot be trusted.

For example, if I want to abuse this and show that content on my website, I can create a proxy page on my application, where I perform a back-end call to your app (adding a valid HTTP_REFERER header) and display results back.