CODEWITHSUNDEEP
phppostsecurity
coen
coen

Reputation:

how to enable cross domain POST-ing in PHP?

I'm tying to send POST data from one site to another (both sites have been developed by us). The problem is that the POST variables are not available if the page is requested from another domain. Even if I test it locally, but specify the complete url, the POST data is gone.

So, this will work:

<form method="POST" action="test.php">

But this will not:

<form method="POST" action="http://example.com/test.php">

Here is the HTML for the page:

<html>
<head>
    <title></title>
</head>
<body>
    <form method="post" action="http://example.com/test.php">
        <input type="text" name="request" value="" id="" />
        <input type="submit" value="" id="" />
    </form>
</body>
</html>

After the comments I got that this should work, I tested it on another server and there everything worked fine indeed. This might have something to do with the fact on the first server https is enabled. But if this is the case, I find it strange that I do get information back but that just the POST data has gone missing.

Upvotes: 11

Views: 13881

Answers (4)

Aylon Spigel
Aylon Spigel

Reputation: 39

Thank you. I too found out that redirection to www and https was blocking the performance of my $_POST request. By changing my action to include https://www. I fixed my problem. Thank you

Upvotes: 0

Ruben O
Ruben O

Reputation: 85

Maybe also a timesaver:

If you POST to domain.com make sure it doesn't get redirected to www.domain.com. The redirect doesn't take the POST variables into account , only GETvariables.

If it does get redirected to the www.domain.com add the www. in your POST-action

Upvotes: 1

Paul Dixon
Paul Dixon

Reputation: 300825

As others have said, there should be no problem doing this. I would suggest replacing your test.php script with something simple, like this

<?php
echo "<pre>";
var_dump($_POST);
echo "</pre>";

You should find it works, which means the blame lies somewhere in the "real" script...

Upvotes: 2

Greg
Greg

Reputation: 321578

What you have should work fine - forms came before the same-origin policy - you're allowed to submit to different domains.

If I were to hazard a guess, I'd say there's a 301 or 302 redirect getting in there somehow? Follow the HTTP headers with Firebug for example to be sure.

Upvotes: 19

Related Questions