Question

I have an HTML code that request to PHP server. I want to just attend requests done my HTML code, not the others. I thought doing something like a token with javascript and answer just for correct tokens, but I have a problem: I use MediaWiki and the javascript code is “open source” (and yes, the POST request is done from the MediaWiki).

Does anyone know how to do a private POST request?

Answer 1

Generate a random token like

$_SESSION['token']=sha1(uniqid(mt_rand(), true));

Put the token value in a hidden input

<input type='hidden' name='token' value=$_SESSION['token'] />

Then, in your php check if the token was sent

if($_REQUEST['token']!=$_SESSION['token']){
    syslog(LOG_ERR, "Request from other site ...");
    die("Request failed. (Disabled cookies?) Contact administrator: ...");
}

Look this link: http://en.wikipedia.org/wiki/Cross-site_request_forgery