阻止某些站点的POST数据

Question

I have page.php which receives POST data, it's located in a known position. How can I obtain the url of each page that sends data to page.php via POST, or how can I block/allow POST data from certain sites?

Answer 1

You can (although not reliably) get the URL of the referring page via $_SERVER['HTTP_REFERER']. There are, however, a number of situations where this will be blank (most commonly when coming from an HTTPS site).

The only reliable way to limit which sites can cause a browser to submit data to your script which will be accepted is to implement protection against CSRF and stop all sites that are not your site.

Generate a random token. Store that token in a cookie or session. Store it in a hidden input in the form. When the form is submitted, check if the token in the form matches the token in the cookie/session. If it doesn't, then the form that submitted the data was not on your site.

---

I use PayPal IPN, so I need to check if POST comes from PayPal

You're trying to solve this problem the wrong way.

Read Paypal's IPN documentation. They provide a means to determine if the event came from them or not.

1. PayPal HTTP POSTs your listener an IPN message that notifies you of an event.
2. Your listener returns an empty HTTP 200 response to PayPal.
3. Your listener HTTP POSTs the complete, unaltered message back to PayPal; the message must contain the same fields (in the same order) as the original message and be encoded in the same way as the original message.
4. PayPal sends a single word back - either VERIFIED (if the message matches the original) or INVALID (if the message does not match the original).