What options are there for verifying that mturk is requesting my ExternalQuestion and not a 3rd party?

Question

I have a django application that I want to host a form on to use as the template for an ExternalHit on Amazon's Mechanical Turk. I've been trying to figure out ways that I can make it so only mturk is authorized to view this document.

One idea I've been considering is looking at the request headers and confirming that the request came from Amazon. However, I couldn't find any documentation regarding any of these topics and I am worried that if the source of the request ever changes the page will become inaccessible to mturk.

Anyone have any suggestions or solutions that they have implemented?

Fyi, I'm using python/django/boto.

Answer 1

Every request from AWS will include additional URL parameters: workerId , assignmentId , hitId . That's probably the easiest way to identify a request coming from MTurk. There may be headers, as well, but they're not documented anywhere.