问题描述
确定当前页面发送或调用(通过AJAX)页面的最可靠，最安全的方法是什么.由于(缺乏)可靠性，我不想使用$_SERVER['HTTP_REFERER']，我需要被调用的页面仅来自源于我网站的请求.
我正在寻找从我的网站页面上调用执行一系列动作的脚本.
What is the most reliable and secure way to determine what page either sent, or called (via AJAX), the current page. I don't want to use the $_SERVER['HTTP_REFERER'], because of the (lack of) reliability, and I need the page being called to only come from requests originating on my site.
I am looking to verify that a script that preforms a series of actions is being called from a page on my website.
推荐答案
REFERER由客户端的浏览器作为HTTP协议的一部分发送，因此确实不可靠.它可能不存在，可能是伪造的，如果出于安全原因，您就是无法信任它.
The REFERER is sent by the client's browser as part of the HTTP protocol, and is therefore unreliable indeed. It might not be there, it might be forged, you just can't trust it if it's for security reasons.
如果您想验证请求是否来自您的站点，那么您不能这样做，但是您可以验证用户是否已访问您的站点和/或已通过身份验证. Cookie是在AJAX请求中发送的，因此您可以依靠它.
If you want to verify if a request is coming from your site, well you can't, but you can verify the user has been to your site and/or is authenticated. Cookies are sent in AJAX requests so you can rely on that.
这篇关于在PHP中确定引荐来源网址的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！