Question

I have a PHP script hosted on my site that outputs a value based on the GET parameters passed.

Other sites call this script from within their own PHP scripts via the PHP function file_get_contents with the url and get params and are served back just the value requested.

I am trying to allow only certain domains access to this script and have been using HTTP_REFERER to check who’s calling the script.

if (isset($_SERVER['HTTP_REFERER'])) // check if referrer is set
{
    echo $_SERVER['HTTP_REFERER']; // echo referrer
}
else
{
    echo 'No referrer set'; // echo failure message
}

I am getting No referrer set when I use file_get_contents but if I use a clicked link from a page to a script with the above code the referrer displays correctly.

Am I using the wrong function (file_get_contents) to call the external script and can someone suggest the correct one or should this work?

Any help much appreciated.
Thanks

Answer 1

You would be much better to restrict based on IP address rather than domain, much more reliable. Just keep an array of allowed IP’s and call in_array($_SERVER['REMOTE_ADDR'],$allowedAddresses) to validate it.

Or just require authentication via a cookie or HTTP auth…