Re: Referer checking is able to be referer spoofed
| From: | Marek Kilimajer | Date: | Sat, 19 Mar 2005 23:14:44 +0000 |
| Subject: | Re: Referer checking is able to be referer spoofed | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-211120@lists.php.net to get a copy of this message | ||
Dotan Cohen wrote:
On Sun, 20 Mar 2005 09:38:29 +1100, dan rossi <daniel@electroteque.org> wrote:The image can be hotlinked too ;)On the referring site have an image that is hosted on YOUR domain. Set a cookie when the user's browser requests the image. Even a 1x1 gif in the corner will do: you just need it to come from your domain. Then validate against that cookie.Hmm its the exact setup with how the video filenames are generated in the player to prevent hotlinking. I guess I am on my own, my client has very paranoid customers as they have to pay for the bandwidth. Lets see how I go. But theoretically we must assume these people dont have php.It looks like we may go with a tokenizer url system, but it means the customers will need php oh well.