PHP cors validation

Posted by Brian Putt on Stack Overflow See other posts from Stack Overflow or by Brian Putt
Published on 2013-11-03T03:48:10Z Indexed on 2013/11/03 3:53 UTC
Read the original article Hit count: 167

Filed under:

php

|

cors

I have an endpoint that takes GET requests to collect data from any source that wants to send data.

Is there a way to run some validation that the data is in fact coming from the sources we allowed? They enter the website url that they will be sending the data from and we generate an api key.

The data is sent via a javascript file that they install onto their website.

I have the Access-Control-Allow-Origin set to * as it doesn't necessarily scale to add in hundreds or more websites to that header and that in itself is a security risk as it shows anyone who wants to look at the headers who uses the script.

Currently I am thinking of using the http_origin / origin referrer, but obviously that doesn't do too much

© Stack Overflow or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about cors

Amazon S3 supporte CORS, la spécification ouvre les ressources de la plateforme Cloud aux applications Web

as seen on Developper.com - Search for 'Developper.com'
Amazon S3 supporte CORS la spécification ouvre les ressources de la plateforme Cloud aux applications Web Amazon Web Services (AWS) a ajouté le support de la spécification CORS (Cross-Origin Resource Sharing) à sa plateforme Cloud Amazon S3. CORS est une norme qui offre aux développeurs la… >>> More
Apache Solr: Setting HTTP Response Headers From solrconfig.xml For CORS

as seen on Stack Overflow - Search for 'Stack Overflow'
Is it possible to setup the sending of a custom HTTP response header from within the solrconfig.xml file? I am thinking that it might be possible to add some configuration to the <requestDispatcher> since it controls caching headers. I am sure this is possible in the servlet container configuration… >>> More
PHP cors validation

as seen on Stack Overflow - Search for 'Stack Overflow'
I have an endpoint that takes GET requests to collect data from any source that wants to send data. Is there a way to run some validation that the data is in fact coming from the sources we allowed? They enter the website url that they will be sending the data from and we generate an api key. The… >>> More
WebGL CORS error loading simple texture in Chrome

as seen on Game Development - Search for 'Game Development'
Here's my code: function loadTexture() { textureImage = new Image(); textureImage.onload = function() { setupTexture(); } textureImage.src = "jumper2.png"; } function setupTexture() { texture = gl.createTexture(); gl.bindTexture(gl.TEXTURE_2D, texture); gl… >>> More
LiteSpeed enable Access-Control-Allow-Origin (no response header on CORS request)

as seen on Server Fault - Search for 'Server Fault'
Seriously, I can't find a single page discussing this for litespeed. Using this format in the htaccess "Header set Access-Control-Allow-Origin http://aSite.com" (and https) sends the setting in the http response header, but I still get the "XMLHttpRequest cannot load https://aSite.com/aFile.php.… >>> More