We're building a Drupal module that is going to be given to trusted 'corporate partners'. When a user clicks on a link, he should be redirected to our site as if he's a logged in user.

How should I verify that the user is indeed coming from that site? It does not look like 'HTTP_REFERER' is enough because it appears it can be faked.

We are providing these partner sites with API Keys. If I receive the API-key as a POST value, sent over https, would that be a sufficient indicator that the user is a genuine partner-site user?

  • @John, @PHPAdmin - can I somehow generate a unique 'token' made using the API-key which is given to the user's browser, which should be presented/passed-to my site? The receiving script reads in this value, translates it back to verify that it came from the correct API-key? – siliconpi Feb 28 '11 at 16:23

If a unique login and password combination is sent over https and those credentials are valid then that is a secure way to confirm a partner's identity. That's how most APIs work including those of payment processing companies.

  • Hi @John - I wont be asking for the user's login/password or having them transfer it to my site. The idea is that when the user clicks on that module, he is transferred over to my site and being "from a trusted partner", he is automatically given login privileges. – siliconpi Feb 28 '11 at 14:20
  • You might want to consider using a frame on the partner's site to set a cookie from your site. Then you can use that to identify the user as being from the partner site. – John Conde Feb 28 '11 at 14:26
  • thanks, that does seem like an interesting idea. Is that how most "site-transfers-of-users" happens? Would you know where I can read up on this? What should I 'search' for? – siliconpi Feb 28 '11 at 14:32
  • @Matt look up "cross domain cookies". That should point you in the right direction. – John Conde Feb 28 '11 at 14:35

If a partner website is using your API, you should provide them with a Private API KEY (for server side) and a Public API Key (user side).

This then allows the "modual" to as you say either pass the Public API key via POST or a GET in the URL.

This of coerce can be "faked" but you can give a user a cookie, or store a server side identifier so can only be "faked" once.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.