Question

I have several forms brought in via jQuery .ajax funciton. In the parent page I start a session like this

<php
 session_start();
 $_SESSION['authenticated'] = 'yes';
?>

then in the form that is loaded have a check like this:

<?php
  session_start();
  if($_SESSION['authenticated'] != 'yes') {
  header("Location: http://www.google.com");
 }
?>

I know its not the best, but it’s an attempt to stop people form accessing the forms directly. The problem is that if you go to the parent page, then you can enter the form URL and get there because the session was started when you hit the parent page. How can I destroy the session or remedy this issue?

Answer 1

You can check $_SERVER['HTTP_REFERER'] in your form .php code to see where the request is coming from. An AJAX call will set the HTTP_REFERER to the page it is called from.

if (strpos($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST']) === false) {
   die();
}

It’s not a bulletproof solution. Any page that is publicly accessible can be retrieved by an automated script.