获取来自我网站的请求

Question

I'm having a simple PHP page that generates random json values and returns it to the user. I want to know what website is using this page to get data using curl or javascript. for example:

the PHP page:

$datas['random'] = ['firstValue'=>'Hello', 'secondValue'=>'world'];
header('Content-Type: application/json');
echo json_encode($datas);

now that code will return this value

{"random":{"firstValue":"Hello","secondValue":"world"}}

what I want to do is: if someone used this file in his website using curl or javascript I want to be able to know which website is using it and what website requested it.

if the website http://example.com used this code in the website

var xhttp = new XMLHttpRequest();

                  xhttp.onreadystatechange = function () {
                      if (this.readyState === 4) {
                          if (this.status === 200) {
                              resolve(this.responseText);
                          } else if (this.response == null && this.status === 0) {
                              var reason = new Error('OFFLINE');
                              reject(reason);
                          } else {
                              var reason = new Error('ERROR');
                              reject(reason);
                          }
                      }
                  };


              xhttp.open("GET", "jsonpage.php", true);
              xhttp.send();

I want to be able to know that the website http://example.php requested the file, without using extra value jsonpage.php?website=example.com

is there any way to do it using PHP.

Answer 1

You can check the IP address of the party making the call to jsonpage.php, but to the best of my knowledge, not the domain.

$_SERVER['REMOTE_ADDR'] contains the real IP address of the connecting party. That is the most reliable value you can find.

However, they can be behind a proxy server in which case the proxy may have set the $_SERVER['HTTP_X_FORWARDED_FOR'] , but this value is easily spoofed. For example, it can be set by someone without a proxy, or the IP can be an internal IP from the LAN behind the proxy.

Finally, if your concern is that only some people should have access to jsonpage.php, I suggest you implement either a public/private API key or oAuth to ensure only the right people have access.

Further reading: How to get the client IP address in PHP

Answer 2

您可以使用$_SERVER['HTTP_REFERER']来告诉您哪个网站正在获取您的信息，但它并不可靠，因为很容易从源代码进行更改。