3 ms·
Ask YC: How to prevent email spoofing in web app?
I am creating a web application that accepts submissions via email from users. I use the From: line in the email header to pull up the user information in the database, but this can easily be spoofed. Can anyone offer advice, links, anything, etc.. for a way to fix this problem?
Thanks very much in advance.
- noodle 18y agoa quick, simple (hopefully temporary) solution would be to have them submit some sort of password with the email (not the same one they use to log in). it isn't very secure, but its a level or two of security higher than what you're creating now without any protections.
- olefoo 18y agoThe standard way to do this is to use a randomly generated destination address which can be reset by the user. If you want greater security than that you could have the user include their 'secret word' in the subject line or body of the message; which will work as long as they can reset that too. Do not use this for anything where a single spoofed message could have dire financial consequences.
- ca98am79 18y agothanks - I ended up using something like this
- adityakothadiya 18y agoi'm also interested in the solution of this question. i'm looking for more like a posterous.com kind of email submission. no password or secret word, and email is sent to a common email address. suggestions? pointers?
- ca98am79 18y agomy friend actually just posted to my posterous blog (as me) with a simple one-line php script
- adityakothadiya 18y agowhat's your posterous blog URL? can you please share it?
- rantfoil 18y agoWould love to investigate this for you -- please contact me directly -- garry [at] posterous.com. Thanks!