阻止本地PHP / HTML文件预览在服务器上执行javascript

Question

I have some HTML/PHP pages that include javascript calls .
Those calls points on JS/PHP methods included into a library (PIWIK) stored onto a distant server.
They are triggered using an http://www.domainname.com/ prefix to point the correct files.

I cannot modify the source code of the library.

When my own HTML/PHP pages are locally previewed within a browser, I mean using ac:\\xxxx kind path, not a localhost://xxxx one, the distant script are called and do their process .

I don't want this to happen, only allowing those scripts to execute if they are called from a www.domainname.com page .

Can you help me to secure this ?

One can for sure directly bypass this security modifying the web pages on-the-fly with some browser add-on while browsing the real web site, but it's a little bit harder to achieve.

I've opened an issue onto the PIWIK issue tracker, but I would like to secure and protect my web site and the according statistics as soon as possible from this issue, waiting for a further Piwik update.

---

EDIT

---

The process I'd like to put in place would be :

• Someone opens a page from anywhere than www.domainname.com
• > this page calls a JS method on a distant server (or not, may be copied locally),
• > this script calls a php script on the distant server
• > the PHP script says "hey, from where damn do yo call me, go to hell !". Or the PHP script just do not execute....

I've tried to play with .htaccess for that, but as any JS script must be on a client, it blocks also the legitimate calls from www.domainname.com

Answer 1

Untested, but I think you can use php_sapi_name() or the PHP_SAPI constant to detect the interface PHP is using, and do logic accordingly.

Not wanting to sound cheeky, but your situation sounds rather scary and I would advise searching for some PHP configuration best practices regarding security ;)

Edit after the question has been amended twice:

Now the problem is more clear. But you will struggle to secure this if the JavaScript and PHP are not on the same server.

If they are not on the same server, you will be reliant on HTTP headers (like the Referer or Origin header) which are fakeable.

But PIWIK already tracks the referer ("Piwik uses first-party cookies to keep track some information (number of visits, original referrer, and unique visitor ID)" so you can discount hits from invalid referrers.

If that is not enough, the standard way of being sure that the request to a web service comes from a verified source is to use a standard Cross-Site Request Forgery prevention technique -- a CSRF "token", sometimes also called "crumb" or "nonce", and as this is analytics software I would be surprised if PIWIK does not do this already, if it is possible with their architecture. I would ask them.

Most web frameworks these days have CSRF token generators & API's you should be able to make use of, it's not hard to make your own, but if you cannot amend the JS you will have problems passing the token around. Again PIWIK JS API may have methods for passing session ID's & similar data around.

Answer 2

Original answer

This can be accomplished with a Content Security Policy to restrict the domains that scripts can be called from:

CSP defines the Content-Security-Policy HTTP header that allows you to create a whitelist of sources of trusted content, and instructs the browser to only execute or render resources from those sources.

Therefore, you can set the script policy to self to only allow scripts from your current domain (the filing system) to be executed. Any remote ones will not be allowed.

Normally this would only be available from a source where you get set HTTP headers, but as you are running from the local filing system this is not possible. However, you may be able to get around this with the http-equiv <meta> tag:

Authors who are unable to support signaling via HTTP headers can use tags with http-equiv="X-Content-Security-Policy" to define their policies. HTTP header-based policy will take precedence over tag-based policy if both are present.

Answer after question edit

Look into the Referer or Origin HTTP headers. Referer is available for most requests, however it is not sent from HTTPS resources in the browser and if the user has a proxy or privacy plugin installed it may block this header.

Origin is available for XHR requests only made cross domain, or even same domain for some browsers.

You will be able to check that these headers contain your domain where you will want the scripts to be called from. See here for how to do this with htaccess .

At the end of the day this doesn't make it secure, but as in your own words will make it a little bit harder to achieve .