Member Avatar for DaveyMoyes

Hi Everyone, I am looking to protect a webpage in my website. What I would like to do is check if the webpage has been accessed from a pre determined url.

For example:
Mywebsite.com/webpage.php should only be accessed from predetermined.com/url?id=var

I have been doing some digging around and found the following.

$url = 'http://'. $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];

But I am lost with how to check if the url and var is correct. What I am trying to do is stop users going directly to
Mywebsite.com/webpage.php and only allow users to access the webpage from predetermined.com/url?id=var

Hope that makes sence,
Cheers

Edited by Dani because: Fixed formatting
  • 2 Contributors
  • 3 Replies
  • 248 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Short answer: do not rely on referer or other client-sent headers alone — they can be missing or faked. If you control both sites, the practical and secure pattern is a signed, short‑lived token (HMAC) or a server-to-server verification call. wants the page reachable only when the request originates via a specific URL; was right to suggest a hash, but it needs timestamping, a nonce, and proper verification to be robust.

Recommended flow (high level):

  • predetermined site builds a token that encodes the id, a timestamp and a nonce, then signs it with a shared secret (HMAC-SHA256).
  • mywebsite receives the token, base64-decodes it, checks the timestamp (e.g., <= 5 minutes), verifies the HMAC with hash_equals, and rejects tokens already-used (store nonce or mark single-use).
  • Always use HTTPS. Prefer server-to-server POST/callbacks if you can (avoids URL leaking via referer/history). Rotate secrets and keep TTLs short.

Example PHP (producer and consumer simplified):

// Producer (predetermined site) - build a signed token
$secret = 'long_random_secret';
$id = $_GET['id'];
$ts = time();
$payload = $id . '|' . $ts;
$sig = hash_hmac('sha256', $payload, $secret);
$token = base64_encode($payload . '|' . $sig);
// send user to: https://example.com/webpage.php?token=... 

// Consumer (mywebsite) - validate token
$raw = base64_decode($_GET['token'] ?? '');
list($id, $ts, $sig) = explode('|', $raw, 3) + [null,null,null];
if (! $id || abs(time()- (int)$ts) > 300) { http_response_code(403); exit; }
$expected = hash_hmac('sha256', $id . '|' . $ts, $secret);
if (!hash_equals($expected, $sig)) { http_response_code(403); exit; }
// optionally check/mark nonce to prevent replay

Cautions: tokens in URLs may appear in logs or referrers; use POST or server API for sensitive flows. If you do not control the other site, you must rely on a cooperation mechanism (API, OAuth, or one-time tokens) — otherwise preventing direct access is not reliably possible.

Recommended Answers

All 3 Replies

Member Avatar for Member #120589

headers can be spoofed so $_SERVER variables aren't foolproof. Using a hash in the url based on a session could prove helpful

predetermined.com/url?id=var&conf=hash

Member Avatar for DaveyMoyes

Hi, how would i check if the url is from predetermined.com/url?id=var&conf=hash

Member Avatar for Member #120589

Oh drat. I misread the question - sorry. I assumed it was something else. Too many late nights! Do you own the predetermined site or have any access to the url that is created? i.e. could you change the querystring to suit your needs?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.