CODEWITHSUNDEEP
phpapachewebservercors
Akil Demir
Akil Demir

Reputation: 160

how can I make sure that the origin of the request to my server is legit?

I am developing a web application where I have to make sure the provided origin of the request trough http headers is correct?

let's say I am expecting a request from example.com, the only way to check request origin(as domain) is trough provided request headers as far as I know, I know that I can control the access to the server trough "Allow-Access-Control-Headers:"example.com"" header but what is preventing example2.com putting a origin header that says the request is coming from example.com?

Upvotes: 0

Views: 558

Answers (1)

Sourabh Swarnkar
Sourabh Swarnkar

Reputation: 131

unfortunately you cant, as it can be faked easily. if you application requires top notch security then i suggest you look into AUTH tokens

Upvotes: 1

Related Questions