阻止用户通过URL注册[关闭]

Question

So what I'm planning on doing is basically have users sign up through an app, I plan on doing this using a REST API. Since I've never done this, I'm understanding a bit of exactly what it is. So what would happen is the user would sign up and I'd pass data like this.

http://localhost/signup/index.php?name=Joe&email=[e-mail]

But since its an app, I don't want people signing up like that over a URL. So my question is, how can I approach this? I know I'd work with JSON for all the other stuff, but is there a safer way to do all of this?

Answer 1

I think you can use either http get or post and that you have several options:

• Check the referrer url so that it's your url and not an unknown
• Use a preview / confirm url so that users must preview and confirm their signup
• Use a token (a one-time ticket or session ID) from your form
• Use an http session variable that you issue in step 1 and varify in step 2
• Check HTTP header and adjust server so that it only accepts "legal" connections

I would use a framework to not reinvent what's already been done. Application frameworks and APIs already have user models and signup applications that you could reuse.