3 ms·
How would I get the domain name from which the request originates? Referrer info can be easily spoofed on HTTP, and HTTPS does not forward referrer information
by bgdam 12y ago
How would I get the domain name from which the request originates? Referrer info can be easily spoofed on HTTP, and HTTPS does not forward referrer information at all.
Without being able to verify that the request is originating from the domain that is specified in the hash, it is still susceptible to the same attack. The hash, challenge and token are all still available client-side.
Basically the hash might say that it is from abc.com, but it could really be from any domain. So yes while the token might match the hash, if both the token and hash are copied it does not help.
- davismwfl 12y agoTrue, I should have thought through that a little more. The domain could be spoofed, making it less than secure and leaving you open to the same issue. For what it is worth, on our client accessible API, we require clients to authenticate and then send in the token we return through the http header for each request, and the token is reset often. The token is a hash of a few client identifiers, but it is calculated and sent to the client so the client never calculates it. We only allow https for the API. This seems to be a fairly common pattern. EDIT: add link This method is similar to how we calculate our token: http://billpatrianakos.me/blog/2013/09/12/securing-api-keys-in-a-client-side-javascript-app/ http://billpatrianakos.me/blog/2013/09/12/securing-api-keys-...