Re: Referer checking is able to be referer spoofed
| From: | Dotan Cohen | Date: | Sat, 19 Mar 2005 23:01:02 +0000 |
| Subject: | Re: Referer checking is able to be referer spoofed | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-211119@lists.php.net to get a copy of this message | ||
On Sun, 20 Mar 2005 09:38:29 +1100, dan rossi <daniel@electroteque.org> wrote:
> >
> > Hmm its the exact setup with how the video filenames are generated in
> > the player to prevent hotlinking. I guess I am on my own, my client
> > has very paranoid customers as they have to pay for the bandwidth.
> > Lets see how I go. But theoretically we must assume these people dont
> > have php.
>
> It looks like we may go with a tokenizer url system, but it means the
> customers will need php oh well.
>
On the referring site have an image that is hosted on YOUR domain. Set
a cookie when the user's browser requests the image. Even a 1x1 gif in the
corner will do: you just need it to come from your domain. Then
validate against that cookie.
Dotan Cohen
http://Liriks-Song.com/
http://Song-Lirics.com/