PHP随机密钥验证

Question

I am making an AJAX request to a script called return.php that will look like this:

http://www.example.com/return.php?type=3&filter=2

This occurs when a browsing user hits a button on example.com

I want additional security measures so that this can only be requested by a user browsing my site. No direct type ins, etc.

So I was thinking to send some type of randomly generated key along with the request. What methodology would I use to verify at return.php that a correct key has been sent?

Can I generate a key and store it in a session variable that is then accessible in return.php?

pseudo code:

 if ($random_key_sent == what it should){
      //go ahead and execute code
    }
else{
     //sorry can't help
    }

And Ultimately my request would look something like:

http://www.example.com/return.php?type=3&filter=2&key=8fu5jtugy489kgvuri09984ufjlgi (or whatever the key would be)

Bottom line I am looking for a way to generate some type of added security so that return.php is only being used when it should be, along the similar lines of using API keys etc.

Answer 1

If you are worried about "direct type-ins" but still need to use GET requests, you can check the request headers in PHP to only allow Ajax requests using $_SERVER['HTTP_X_REQUESTED_WITH'] .

if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
    // Do what you need to do
} else {
    die("Ajax Only");
}

(Modified from David Walsh )

Answer 2

You're looking for cross-site request forgery (CSRF or XSRF) protection.

Typically, you generate and save an anti-CSRF token in the user's session data, and put it in a hidden form field (using either GET or POST), or for normal links you place the token in a query parameter. On the server side, you check that the anti-CSRF token matches the one in the user's session data.

Some suggest that you can achieve the same level of security by simply checking the HTTP referer header. That can work, but is less reliable since people can block the referer for privacy reasons.

Answer 3

Unless you're going to have a list of preset keys that your PHP code checks against and the browser can receive to then send in the URL, it would be impractical to check the key for a specific value. You could just check if the $_GET["key"] array value is set:

if(isset($_GET["key"])){
    // go ahead and execute code
}else{
    // sorry can't help
}

Alternatively, you may want to consider requiring the browser to set some POST data which is sent along with the request to the webpage, but cannot be typed into the address bar. Then just use $_POST["key"} rather than $_GET["key"] to verify.