Simple PHP form post API based on unique parameter/key

Question

I'm interested in what might be the options for securely implementing a dead simple API that allowed websites to register on my site, receive and copy the unique HTML form to their website that would ultimately post to my API.

E.g.:

A church at URL: www.church.com buys 5 submits of my service.
I provide that church a HTML form that they then copy into their website.
2b. The form would post back to my API/URL with an unique key specifying it's coming from www.church.com (key=1234)

<form action="https://www.example.com/myCustomAPIService.php?key=1234" method="post">
  First name: <input type="text" name="fname"><br>
  Last name: <input type="text" name="lname"><br>
  <input type="submit" value="Submit">
</form>

What would prevent say another organization from copying the HTML to their site?

Would checking $_SERVER["HTTP_REFERER"] solve this problem?

$_SERVER["HTTP_REFERER"] IS NOT RELIABLE. See here for more options. — Dipen Shah
– Dipen Shah, Commented Dec 21, 2015 at 21:51
referers are not, never have been, and never will be, a "security system". they're "hello my name is" tags and can contain ANYTHING the user wants. — Marc B
– Marc B, Commented Dec 21, 2015 at 21:51

Petr · Accepted Answer · 2015-12-22 00:50:42Z

2

You cant rely on anything coming from the user, so there is no 100% secure way using HTML only.

You need some secret. For example:

Church.com send request to your web server with secret key for temporary public key for every HTML form it generates
Church.com create HTML form with this temporary key
User send form with this temporary key to your site
You will check temporary key if it is valid

Or:

church.com create html form
User send form to church.com
church.com send values from this form to your website with his secret key

etc.

answered Dec 22, 2015 at 0:50

Petr

1,19911 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Simple PHP form post API based on unique parameter/key

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related