3

I would like to put a link back to my site on other "approved" domains. When they click on the link it goes to a page that checks the referrer ($_SERVER['HTTP_REFERRER']) to make sure they came from a domain that is approved to have my link. This can be spoofed so how can I make sure the clicks are actually coming from the approved domains?

Mickey
  • 2,285
  • 6
  • 26
  • 37

1 Answers1

8

You can't do it. You can't prevent the referrer from being tempered with.

An alternative would be possible if there's collaboration between the several sites. For instance, the links in the other sites to yours could pass a token as a parameter in the URL that would be usable only once and which you could then validate.

Several validation strategies would be possible. Your site could contact the other site and ask it if the passed token is valid or you could employ a signature with the token acting as a nonce so you didn't have to contact the other site.

Artefacto
  • 96,375
  • 17
  • 202
  • 225
  • 1
    Indeed, was writing about the same. Affiliates and the like usually solve this by bouncing back & forth setting some cookie & get parameters in the url they can validate, and which meaning cannot easily be cracked (hashes over url & salt and the like). – Wrikken Jul 25 '10 at 18:06
  • 1
    The signature generation and validation would be similar to what OAuth does - you could even look at using the code from an OAuth library to do this. Make sure there is a timestamp parameter in the URL which you can check to prevent re-use of stale links. Either give enough leeway in the time check for people to click links a while after they are loaded, or make the links on the page actually redirect to a freshly generated & signed URL, allowing you to have a much shorter expiry time. – Nick Jul 25 '10 at 18:15
  • Using a timestamp based nonce is a good strategy because you don't need to store all the nonces you have ever seen to deny them in the future. You could only store those seen in e.g. the last say 3 hours and reject all that are older. If can live with some reused tokens in a small timespan you could even store nothing at all. – Artefacto Jul 25 '10 at 18:23
  • What's this nonce stuff all about? – Mickey Jul 25 '10 at 19:45
  • @arfecto, i can't trust the other domains, so i can't rely on them to pass back the correct data to ensure the click is valid & thanks for clarifying what a nonce is. I have to make sure the link being clicked on is actually coming from an approved domain, similar to how affiliate marketers do it. – Mickey Jul 25 '10 at 19:56
  • @John It's the client that claims he comes from a certain website, the website only certifies that what the client says is true. Sure, the other websites could make public the secret they use to generate the links, but you have no way to control that. – Artefacto Jul 25 '10 at 20:07
  • @artefacto, thanks again for clarifying. so is there any way to make this work? – Mickey Jul 25 '10 at 22:43
  • @John Since the only way is to add some parameters to the link and the link is shown by the other sites, there's no way to protect yourself against rough sites that leak the link generating secret. – Artefacto Jul 25 '10 at 22:59
  • well how does google adsense or the google maps http api work, more specifically how does the maps api enforce a limit on requests if the IP can be spoofed? – Mickey Jul 26 '10 at 00:06
  • @John An IP cannot be spoofed (over the Internet). – Artefacto Jul 26 '10 at 00:13
  • Ok, well if the only variable I have to check for is $_SERVER['REMOTE_ADDR'], what can I do to check for the real IP? – Mickey Jul 26 '10 at 00:38