Can I limit a script so it only runs only from my site?

[kaled]

I'm completing a general purpose form mail script (because I couldn't find one I liked).

Is there any way to ensure that the script fails if run from another site. I could use the HTTP_REFERER var except that there is no guarantee it is defined.

Best I can figure is NO - but I'd like to be wrong.

Kaled.

[claus]

Snipped directly from a well-known public script:

@referers = ('www.example.com','example.com'); 
  
if ($ENV{'HTTP_REFERER'}) { 
 foreach $referer (@referers) { 
  if ($ENV{'HTTP_REFERER'} =~ m¦https?://([^/]*)$referer¦i) { 
  $check_referer = 1; 
  last; 
  } 
 } 
} else { 
 $check_referer = 0; 
} 

[VectorJ]

The only things I can think of is that you can either set a cookie whose value is encrypted that will allow the user to use the form mail, or set up a system where the user has to log in. You could also monitor the output from the form mail and if the same person (identified by cookie, ip, user agent, or a combination of all three) tries to send more than one or two emails, you shut them down.

[kaled]

Thanks for the code snippet and cookie suggestion.

I guess I could also check ip addresses and set a limit of, say 3 a day from the same IP address. Could be a problem with proxies though.

Thanks again,

Kaled.

[claus]

>> 3 a day from the same IP address

It's also a problem for people accessing the script from shared IP's (ie. work, schools...) and for people on dynamic IPs.

Here's a modified version of the script snippet. It will send you back to a specific address and terminate the script if you don't come from the right domain. OTOH, if you come from the right domain it will just carry on with the rest of the script. Place it before the rest of the code.

--------------------------------- 
@referers = ('www.example.com','example.com'); 
$go_back_to = "http://www.example.com/some-page.htm"; 
  
if ($ENV{'HTTP_REFERER'}) { 
 foreach $referer (@referers) { 
  if ($ENV{'HTTP_REFERER'} =~ m¦http://([^/]*)$referer¦i) { 
  return; 
  last; 
  } 
 } 
} else { 
 print "Location: $go_back_to\n\n"; 
 exit; 
} 
---------------------------------

[kaled]

I'm going to use referrer tracking as suggested but I've also decided that the potential for misuse is so great that I'm currently implementing a whole raft of options that are stored in a file beside the script. Hopefully, this will make it as secure as reasonably possible (by limiting the domains that you can send to, for instance).

One of these days I'll learn to write a simple program. I thought I'd get it done in ~ 150 lines of code. I'm well on the way to 400. Nevermind, it's a good way to learn Perl I guess.

Kaled.

[inwebsys]

Good idea, the referrer check is just not good enough to thwart a determined spammer. It can easily be forged.