Can we ever determine if the request was sent from another domain?

I've read these webpages:

PHP Form Security With Referer and http://www.mustap.com/phpzone_post_62_how-to-bypass-the-referer-se

So basically my question is how do we determine for certain that the request was sent from our own domain? Or is there no way at all?

(Question targeted at any server side language including but not limited to PHP/JSP/ASP.Net etc)

My Problem: I have a page at http://me.com/login and on form submit, it will post to itself the login particulars. So far so good. until someone else can simply do this

  <form action="http://me.com/login">
  <input name="password" value="p">
  <input name="username" value="u">
  </form>

and they can send a request to login to my application through their domain. I do not want this. I need a way to make sure that if my page receives a post, its from my domain. Else i will reject it.

Besides, I'm abit shock when i read this: There are plugins for Firefox that allow the user to specify whatever value they want to be supplied as the REFERER. source: http://www.phpbuilder.com/board/showthread.php?t=10324100

So we don't even need a hacker to break it now. Just about anyone could do it.

I need a solution to make 开发者_高级运维sure that i reject ALL requests not from my domain.

So basically my question is how do we determine for certain that the request was sent from our own domain? Or is there no way at all?

You are asking the impossible. There is no way to know for certain that a submit button on a page on your domain generated the request.

You say it's not about CSRF, so I don't know why you are concerned. But the solutions are the same.

1. Check the HTTP_REFERER header anyway. If it isn't your domain, then reject the request. You'll probably need to accept missing headers though since some people disable it. This doesn't prevent people who mess with their browser settings from spoofing the value though. But it does prevent people who are tricked into submitting the form from another site (assuming they haven't disabled HTTP_REFERER).

2. Use a "nonce" or temporary token that is only valid for one request. Hence, the person who submits the request must visit your website at least once per request. This is basically the same thing as ensuring that the request originated from your website. You can also tie a nonce to an IP address or session to prevent people from querying your site and relying the token along to another computer.

There's no way to make sure where's the origin of the request. This is the nature of HTTP state-less protocol.

In common Referrer HTTP header is used as the source of request, but it can be manipulated easily.

Use a hidden input with an encrypted key that is held on your server, and make it change frequently (I give 30 seconds before it changes!). This wont stop it but will minimise the risk, also, log the failed attempts per IP and block that IP/user after the 4th failed attempt until re-verified via email. If the username that had the failed attempts doesn't match the DB after the 4th time, block the IP and give an email to contact.