如何验证 API 请求是否来自某个域？
我有一个 Web API，我希望允许任何域向其提交数据。但是，为了减少虚假垃圾邮件，我想找到某种方法来确保声明来自某个域的请求实际上来自该域，并且有人不会试图通过在另一个域上发帖来欺骗我域代表。
例如，如果 http://example.com 提交一些数据 - 那很好。如果 script Kiddie #237 提交的数据声称是 example.com - 那很糟糕。
起初，我打算使用密钥系统对每个请求进行 HMAC 签名 - 但该 API 的注册将是开放、免费和自动化的。我不确定如何判断 PersonA 或 PersonB 是否真正拥有 http://example.com 并且值得 API 密钥。
I have a web API that I want to allow any domain to submit data to. However, to keep bogus spam down I want to find some way to insure that a request stating it's from a certain domain actually is from that domain and that someone isn't trying to trick me by posting on another domains behalf.
For example, if http://example.com submits some data - thats good. If script kiddie #237 submits data claiming to be example.com - that's bad.
At first I was going to use a secret key system to HMAC sign each request - but signup is going to be open, free, and automated for this API. I'm not sure how I could tell if PersonA or PersonB really owns http://example.com and deserves the API key.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
提供他们必须上传到该域的密钥文件。然后您根据内部数据库检查数据是否存在以及有效。
Provide a key file that they will have to upload on that domain. And you check the existence and valid data against your internal database.