How should I restrict direct url access to a form mail script in perl-cgi?

Question

2.00/5 (1 vote)

See more:

SQL

Hi,
My project is running on a apache server on CentOs.My project is one-page site that contains a form that send mail when submitted.I write that form mail script in perl cgi.It is able to send mail when submitted but I want to restrict the direct url access to that mail script.How should I do,please?

Posted 22-Oct-15 23:58pm

Member 12081297

Add a Solution

Comments

Sergey Alexandrovich Kryukov 23-Oct-15 16:16pm

You can check up the HTTP referral.
—SA

Member 12081297 23-Oct-15 23:52pm

Sir Sergey Alexandrovich Kryukov,Thank you very much.

Sergey Alexandrovich Kryukov 24-Oct-15 2:03am

You are welcome. I also added more useful information and considerations in Solution 1, please see.
Will you now accept the answer formally?
—SA

Member 12081297 26-Oct-15 1:14am

Of course,sir.

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sergey Alexandrovich Kryukov · Accepted Answer · 2015-10-23T20:02:00

As a first line of defense, you can check up the HTTP referral, which is one of the HTTP header fields of an HTTP request:
https://en.wikipedia.org/wiki/List_of_HTTP_header_fields#Request_fields[^],
https://en.wikipedia.org/wiki/HTTP_referer[^].

All scripting modules for all non-nonsense HTTP servers allows you to check up this fields. If the referrer is not what's expected for your mail script, you script should not handle this HTTP request with normal processing including sending the mail.

On Perl, see also: http://www.perlmonks.org/?node_id=747530[^].

Note that this is not 100% reliable defense, because the HTTP request can be spoofed. That's why I called it "first line of defense".

Now, this is, by far, not the only security concern of the mail script, which is potentially quite a dangerous part of Web sites. I discovered amazingly simple let efficient exploit (from real-life experience) which could turn your Web host into a zombie spreading spam in no time. I described it, as well as the protection, in my past answer:
unable to send mail , it showing the error in below code .[^];
see also: In what way $('#myelement').valid(); works[^].

Good luck. Be safe.

—SA