All geek questions in one place

How do you confirm that an API request comes from a specific domain?

I have a web API that I want to allow any domain to send data to. However, in order to preserve fictitious spam, I want to find a way to guarantee that the request pointing it to a specific domain is indeed from that domain and that someone is not trying to trick me by placing it in another domain.

For example, if http://example.com provides some data, that’s good. If script kiddie # 237 provides data that claims to be example.com, this is bad.

At first I was going to use a secret key system to subscribe HMAC to each request, but registration will be open, free and automated for this API. I'm not sure how I can determine if PersonA or PersonB really owns http://example.com and deserves an API key.

+3
source share
1 answer

Provide the key file that they will need to upload to this domain. And you check the availability and reliable data on your internal database.

+2
source

Source: https://habr.com/ru/post/1777196/

More articles:


All Articles