Hello,
ExternalSite sends a request to my site. Is there a way to verify the request source, and make sure it’s coming from ExternalSite? I don’t have access to ExternalSite server. I know that $_SERVER isn’t of any help in that case, so I guess it’s a more complicated scenario that awaits me.
Regards,
-jj. 
You can use $_SERVER[‘HTTP_REFERER’] to identify the referral link from where the request is coming.
It can’t be trusted, can it?
Yes, I agree with you. But I don’t know any other reliable method to track viewer’s path.
I assume external site has a set IP address? Just verify the IP address.
As long as the enternal site is doing the request and not in the form of an iframe.
The form is sent from the external site. It could be anyone filling this form and posting it directly to my website. I’m trying to find if, in that scenario, it is possible to know if the form has been filled on ExternalWebsite and sent from it. I guess a token will be necessary.
You would need a token that is generated for each request that only you and the external site would know how to generate. Otherwise, no there is no way to reliably verify the request was from some form on a paticular site.
How would such a token be generated? I can’t understand how two different servers could come up with the same token.
What about a key that both sites would share?
The shared key would be the salt ([google]php salt[/google]) the way you then create the rest of some convoluted key is up to you, its usually done with some other factor such as the date and some esoteric PHP functions.
I would really be interested in knowing more. I must admit that I’m a bit lost and wouldn’t know where to start. I don’t like to do that, but could ou show me some code?
How would you create the salt, share it, store it?
How would you create the key, store it, share it?
Why couldn’t I send some sort of password using POST? It could be intercepted?