CODEWITHSUNDEEP
phphttpssl
user1626498
user1626498

Reputation: 139

validate HTTP requests with header "origin"

  1. I have a REST API in https://domain1.com
  2. I want to accept requests only from https://domain2.com

Question, Can I rely on the "origin" header to accept request only from https://domain2.com?

Note that Both websites are secured with SSL

It would be something like this:

$headers = getallheaders();
if($headers['origin'] != 'https://domain2.com'){
    return FALSE;
}

Upvotes: 2

Views: 1915

Answers (1)

kicken
kicken

Reputation: 2167

Relying on the Origin header would be similar to relying on a Cookie. A well-behaved client (such as a browser) will send it with the correct value. An attacker would simply spoof it to whatever value they need to get your service to work.

You can use it as a way to prevent someone from using your API on their site directly from the browser. You cannot use it to prevent someone from using your API via a proxy or accessing it directly to download data.

Upvotes: 4

Related Questions