Jason-> Re: [PHP] referrer

> > Is there ANY way to get from where the client is coming and then compare it > > to get a true/false result *without* > > using http refferer? > > No. Damn, couldnt you tell me gently? :-D > > > I just checked and http referrer is not working on my domain... Good news, its working now! I just "slightly" wrong code :-) > > Never rely on http referrer for 'security' checks -- it can be easily set to > whatever the client chooses. I know, I am using MD5 together with a timestamp (among other things) for my main security but I also wanted to add this...am building a security package for 2checkout that wll offer secure instant downloads. My architecture is the "onion" kind, in layers. Right on top is MD5 and right below my last line of defense is http_referrer. > > Where is your site? Are the downloads worth having? If so, I'll grab some for > free ;-) Give me some time and I'll give you the download location as this is still under part development, I would really like if someone would like to test it out...so far everyone has failed in getting in. > > > and i need > > to make sure the client is coming from > > https://2checkout.com as I am > > offering instant downloads... > > Most payment gateways gives you instant verification on whether a transaction > has succeeded. Use that to determine whether or not to grant download. I know, I am using all of their verification systems but am also implementing a few of my own, when talking about security being paranoid is not a bad thing...dont you agree? Cheers, -Ryan > > -- > Jason Wong -> Gremlins Associates -> www.gremlins.biz > Open Source Software Systems Integrators > * Web Design & Hosting * Internet & Intranet Applications Development * > ------------------------------------------ > Search the list archives before you post > http://marc.theaimsgroup.com/?l=php-general > ------------------------------------------ > /* > A strong conviction that something must be done is the parent of many > bad measures. > -- Daniel Webster > */ > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php >