Question

I have a page that I want to execute via cron. It just does some pretty simple archiving stuff, nothing super high-security, no DB access etc.

Is it a secure practice to simply require a GET var to be present in order to execute the page? So myarchiver.php would be something like:

<?php

$mysecret_word = "abc123";

if ($_GET['secret'] == $mysecret_word){
    // execute my stuff here
}

Then you’d just call myarchiver.php?secret=abc123 in the crontab and the process would run, while any wrong answer or attempt to execute the page with no secret would simply present a blank page (with no extra server load).

I realize this is not “secure” against man in the middle attacks and if the site was compromised– but I believe in general it’s plenty secure to keep this script from being fired by random script kiddies and other idiots who may somehow know about its existence? The thing I’m guarding against is random malicious users who may know about this script bombarding it with requests in order to dos/tie up resources.

EDIT TO ADD: the server is not accessible via SSH and the cron is being executed on a remote machine– so it must be done via an http request.

Thanks for input.

Answer 1

First off, why not just check the IP address of the server making the request?

If it has to be done via an HTTP request and simply checking the IP address isn’t an option, you can have your cron run a script similar to “runcron.php”. That script would in turn make a CURL or WGET request to the actual cron script you want to run.

That would allow you to pass a dynamic hash instead of a static key. That would prevent someone from just repeating the HTTP request if they happen to sniff the traffic. For the hash you could use anything dynamic like the date combined with a salt.

Example:

if (md5('secretword') . date('H')) == $_GET['hash']) { // do cron }

That would at least rotate your key once an hour.