A website that I co-own has been asked us to add some content to our site which is great advertising for us. The catch is that because of the nature of our company, we have to be very careful about who has access to our site. (We distribute music for labels to radio stations)
Following so far?
So I have started a new page for the content. I think I want to have some kind of hashed string with the calling site name, a key for our site and maybe the date, encrypted and included in the query string or cookie being sent from the calling site. The goal would be to prevent this from being called from other sites (their site is password protected as well), including DNS spoofing to trick my site to think it is being requested from that site.
So I think this is a good solution.
- Is it? If not, what should I try instead?
- How the heck do I do that? I think I would have the API called inside an iFrame on their site, with the source as my site and page with the query string, but how should I get the calling site URL? And what should I use to encrypt the query string key?
I would recommend using Public key cryptography. For each user, generate a public key which you send them, and a private key for your records.
They should encrypt the current time along with other self-identifying information like IP address. Then when you receive the handshake, you can decrypt it using the private key, and then verify the time is not too far off, the IP address is correct etc.