PHP安全性，仅允许来自特定URL的$ _REQUEST

Question

I have a simple PHP script which accepts a $_REQUEST from a javascript Ajax call and adds a post to the DB

But I need to ensure that only javascript requests from my domain is allowed, to prevent someone from submitting thousands of junk posts to my DB.

My question is, how do I ensure that my script only accepts $_REQUEST from my domain?

Thanks

Answer 1

The short answer is: You can't.

It sounds like you need to introduce the usual defences against CSRF (i.e. to generate a random security token and store it in a cookie (or session) as well as in your HTML document. You then submit the token as part of your request and compare it to the one in the cookie. If they match, then it is an intentional post from the user and not their browser being tricked into making the request by another site).

This won't stop people submitting "thousands of junk posts" though. You also need to authenticate users and check they are authorised to make a submission before allowing it to go through.

You can consider also including rate limiting checks and spam filtering.