PHP 检查以确保请求是来自我的站点的 xmlhttp 或来自某个域的正常请求
如何编写条件以确保页面可以通过来自我的站点或允许的外部域的 xmlhttp 请求进行访问？
<?php
$referrer = $_SERVER['HTTP_REFERER'];
if($_SERVER["HTTP_X_REQUESTED_WITH"] !== 'XMLHttpRequest') {
if(preg_match("/accepteddomain.com/",$referrer) {
header("Location: http://www.domain.com/desiredpage.php");
} else {
header("Location: http://www.domain.com/nondesiredpage.php");
}
}
?>
How would the condition be written to ensure a page is either accessed by xmlhttp request from my site or from an allowed outside domain?
<?php
$referrer = $_SERVER['HTTP_REFERER'];
if($_SERVER["HTTP_X_REQUESTED_WITH"] !== 'XMLHttpRequest') {
if(preg_match("/accepteddomain.com/",$referrer) {
header("Location: http://www.domain.com/desiredpage.php");
} else {
header("Location: http://www.domain.com/nondesiredpage.php");
}
}
?>
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
考虑到 Referer 和 X-Request-With 标头都是由客户端（浏览器或任何其他可以发送 HTTP 请求的设备）发送（或不发送）的，他们不值得信任。
您可以使用这些作为提示，以增强用户体验；但您不能依赖它们的存在或正确性。
基本上，您无法确定请求来自特定域（即使对于 XmlHttpRequest ：浏览器只能在同一域上使用 XHR...但是您无法确定请求来自您的请求）接收是否来自 XHR）。
在可能的想法中（不确定您真正的问题/需求是什么），您可以尝试使用某种 API 密钥来限制请求率等？
Considering that both Referer and X-Request-With headers are sent (or not sent) by the client (the browser, or anything else that can send an HTTP request), they cannot be trusted.
You can use those as hints, to enhance user-experience ; but you must not rely on them to be either present or correct.
Basically, you have no way to be sure that a request comes from a specific domain (even for XmlHttpRequest : the browser can only use XHR on the same domain... But you have no way to be sure that a request you receive is, or is not, coming from XHR).
Amongst possible ideas (not sure what your real problem / need is), you might try using some kind of API-key, to limit request-rates or so ?
您拼写的 Referrer 正确，但不幸的是编写 HTTP 规范的人却拼写错误！您需要使用
HTTP_REFERER。您可能还想转义点
\.，因此它只匹配一个点而不是所有内容。You spelt referrer correctly but unfortunately the person who wrote the HTTP spec couldn't! You need to use
HTTP_REFERER.You might also want to escape the dot
\.so it only matches a dot and not everything.Ajax 请求只能来自同一域。由于内置的安全原因，您无法从其他站点发出 XMLHttp 请求。
该网站完美地概述了您无法启动跨域 XMLHTTPRequest
http://developer.yahoo.com/javascript/howto-proxy.html
所有现代 Web 浏览器都对网络连接施加安全限制，其中包括对 XMLHttpRequest 的调用。此限制可防止脚本或应用程序与网页最初来源之外的任何 Web 服务器建立连接（如果在首选项中启用了该选项，则 Internet Explorer 将允许跨域请求）。如果您的 Web 应用程序和应用程序使用的 XML 数据都直接来自同一服务器，那么您就不会遇到此限制。
Ajax requests are only possible from the same domain. You cannot make an XMLHttp request from another site due to inbuilt security reasons.
This site outlines states perfectly that you cannot launch a cross-domain XMLHTTPRequest
http://developer.yahoo.com/javascript/howto-proxy.html
All modern web browsers impose a security restriction on network connections, which includes calls to XMLHttpRequest. This restriction prevents a script or application from making a connection to any web server other than the one the web page originally came from (Internet Explorer will allow cross-domain requests if the option has been enabled in the preferences). If both your web application and the XML data that application uses come directly from the same server, then you do not run into this restriction.
您需要注意，HTTP 标头很容易被欺骗，因此有人可以轻松地通过 telnet 发送该 HTTP 标头并访问该页面。不要依赖 HTTP REFERER 来获取敏感数据。唯一合理安全的预防措施是使用登录。
You need to be aware that HTTP headers are easily spoofed so someone could easily telnet and send that HTTP header and access the page. Do not rely upon HTTP REFERER for sensitive data. The only reasonably safe prevention is to use logins.