How to protect cross site form submit

Does anyone know how to protect cross site form submit? For example if I have register pag开发者_如何转开发e and user have to enter there own email and password and I do not want anyone submit email and password value from other site to myweb site.

Store secret randomly generated key inside users session. When user will open page with form put inside form hidden input with that value. Check if both match while validating received data after form is submitted.

If you mean you don't want people to be able to submit data in a form hosting on another website to your server one way of preventing that would be to check the Referrer HTTP header however this is not going to work all of the time as it relies on data being sent by the browser and is easily faked.

You would also end up causing hassle to those who turn off HTTP Referrer sending.

Another way to get this to work might be sending an <input type="hidden" value="dsahdbashdbhas[keyboard mash]" /> which will have a value you generate (when the user requests the page) based on their IP address. Then when you process the form you can check for this value and if it isn't correct you can drop the request.

If this is to prevent automated form filling then you should use CAPTCHA

In the web security world, this is a vulnerability known as Cross-site Request Forgery (CSRF). You should be sure to read the Cross-Site Request Forgery Prevention Cheat-Sheet --and other pages-- at OWASP