如何验证从同一服务器提交的表单而不使用 HTTP_REFERER？
我的网站上有此表单，我想阻止用户从本地副本提交表单。或从其他域提交表单（跨站点脚本）。
HTTP_REFERER 不被信任，因为它很容易被伪造。
我有想法通过在提交信息之前调用服务器来验证表单的提交位置。但我不太确定这是否是个好主意。 感谢 伊兰科
I have this form on my site, i want to prevent from users to submit the form from local copy. or submit the form from other domain (Cross Site Scripting).
the HTTP_REFERER is not trusted because its easy to fake.
I have idea to verify where the form was submitted, by calling to the server just before submit the info. but i am not so sure if its good idea.
Thank
ilanko
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这称为 CSRF，通常通过隐藏
输入来解决在表格内。所述输入的值在服务器端分配并存储在会话中。表单提交后，将对这两个值进行比较，并且仅当它们相等时才继续提交表单。That's called CSRF and is usually solved by having a hidden
inputinside a form. Value of the saidinputis assigned on the server side and is stored in a session. Upon form submit these two values are compared and form submission continues only if they're equal.