Restrict getJSON / PHP query to server

Question

I am using a JS library that requires JSON data to be passed to it in order to display information. I need to parse this data via a PHP script, as below:

 $.getJSON('http://example.com/q.php?a=3298&b=test', function(data)...

Is there a way to restrict this query to the server / localhost? I don't want a third-party person or website from being able to retrieve data by going directly to http://example.com/q.php?a=3298&b=test&callback=? .

@Uchiha — Because you'd have to give the key to the client, and if the third party has enough access to figure out the URL then they also have enough access to get the key. — Quentin, Jul 30 '15 at 09:19

score 1 · Answer 1 · answered Jul 30 '15 at 09:18

It sounds like what you want is to not restrict it to localhost, as that would mean that only your server could access this URL (and unless your browser is running on your server and you're the only person using it, this probably isn't what you want).

If I understand correctly, you need a visitor accessing your site to be able to use this within your JS code, but you don't want them to snag the URL, modify the parameters, and pull arbitrary data from your server.

If that's the case, then what you'll want to do is to encrypt or hash the values that you pass. Instead of what you're doing now:

http://example.com/q.php?a=3298&b=test

Do something like this:

http://example.com/q.php?token=fjsdfa6f98sfuspojfj

Where fjsdfa6f98sfuspojfj is something you've pre-created on your server that corresponds with a=3298&b=test. This way, someone can't screw with the token and enter a value that corresponds with other versions of a and b.

thanks but what if the user just then goes to http://example.com/q.php?token=fjsdfa6f98sfuspojfj , whenever they want to get that updated data? — Josh, Jul 30 '15 at 11:36
@Josh, if the user couldn't do that, then your code wouldn't work. There's nothing that's different between the user going there directly, or their browser making an AJAX call.. your server sees the exact same thing. But the other thing you could add to it would be a time requirement. For instance, have the generated token only be valid for X minutes. This way it works on the page that you've generated, but if they store and use the URL later it won't. — Nick Coons, Jul 30 '15 at 18:52

score 0 · Answer 2 · answered Jul 30 '15 at 09:14

0

Use .htaccess:

RewriteEngine on
RewriteCond %{HTTP_HOST} !^127\.0\.0\.1$
RewriteRule ^q.php$ - [F]

Or you can restrict the access via PHP:

if($_SERVER["REMOTE_ADDR"] != "127.0.0.1")
    die();

answered Jul 30 '15 at 09:14

Genhis

1,484
3
27
29

Restrict getJSON / PHP query to server

2 Answers2