Iframe accept request only from a certain page

Question

I want to create a page that will accept request only from a particular page in my server.

For example, in page "script.php", I am adding an iframe like follows, and sending a variable via url.

<iframe src="process.php?pid=587"></iframe>

The problem is, users can get the value returned by process.php simply by putting "process.php?pid=587" at the address bar directly. I want to restrict this so that the value will only be returned if requested by "script.php", otherwise, it will return nothing, or show error.

Is it possible to do restriction in such way in php? If yes, please suggest an way.

Answer 1

You could try $_SERVER['HTTP_REFERER'] but that depends on the server.

You could put something like this at the top of your process.php :

if ($_SERVER['HTTP_REFERER'] != 'script.php') {
    die;
}