CODEWITHSUNDEEP
phpcurl
user849137
user849137

Reputation:

check if page is viewed in browser? PHP

I was wondering if there is any way to check a page has been ran in a browser (by a human) in PHP.

I've got a page that only needs to be accessed through a cURL request. So I don't want users snooping around on it.

any ideas?

thanks

EDIT:

Because this is one of those questions that are not easily found on the web, here's the solution i used:

I came up with an idea thanks to anthony-arnold. Its not very stable, but it should do for now.

I simply sent the user agent in my cURL request:

//made a new var with the user agent string.
$user_agent = "anything I want in here, which will be my user agent";

//added this line in the cURL request to send the useragent to the target page:
curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);

and then I simply wrote an if statement to handle it:

if 
($_SERVER['HTTP_USER_AGENT'] == "my expected useragent - the string i previously placed into the $user_agent var."){

echo "the useragent is as expected, do whatever";
} 

else if 
($_SERVER['HTTP_USER_AGENT'] != "my expected useragent - the string i previously placed into the $user_agent var."){

echo "useragent is not as expected, bye now."; exit();}

And that did the trick.

Upvotes: 2

Views: 1824

Answers (1)

Anthony
Anthony

Reputation: 12407

Check the User-Agent or use the get browser function to check which browser is requesting your page. You could configure your web server to fail unless a specific user agent is specified. You can set the user agent in cURL using the --user-agent switch (see the man page).

Unfortunately, the user agent can be spoofed so you can never be absolutely sure that the one sent by the client is in fact correct.

There is a problem with this idea though. If it's on the public web, you have to expect that people might try to access it in any way! If the HTTP request is valid, your server will respond to it (under default configuration). If you really don't want it accessed by any method other than your prescribed cURL one, then you might need to invest in some further authentication/authorization methods (e.g. username/passphrase authentication via SSL).

Upvotes: 4

Related Questions