Warranty request came from local server

Question

I have a classic ASP page that makes an XMLHTTP request to my ASP.net (C #) page, "doSomething.ashx". They are both hosted on the same server.

How can I guarantee that the request came from the local server to stop malicious users visiting the doSomething.ashx page and make false requests?

Edit:

Stupid, I forgot that I can pass the username + pw through, but it will:

HttpContext.Current.Request.IsLocal 

Work just as well? Or could it suffer from creative hackers?

Answer 1

In the HttpRequest object there is a property:

 context.Request.IsLocal 

This boolean is true if the request came from the same machine!

MSDN docs:

The IsLocal property returns true if the IP address of the sender of the request is 127.0.0.1 or if the IP address of the request matches the IP address of the server.

Answer 2

You will need to add some token unique to this request / session. If it is simply authenticated, you can guarantee that it came from someone with details, but it can still be "faked" from this user.

You can either check all the “known” tokens with an expiration date, or use a session-based system and check its correctness in the request handler.

If only tokens are used. you will need to generate them on the server when sending the page that makes the request, and then it is checked when processing the request itself.

Answer 3

Simple, you authenticate the request.