[PHP] Referer checking is able to be referer spoofed

[dan rossi]

Hi there I am building a syndicate feed system for a client, it is 
based on referer checking and a id is passed over, I could do what I do 
with the expired url and generate a random string of some sort to login 
the user automatically, but then it relies on the third party to have 
php. I have tested with a referer spoofing app, and its true, it will 
still let you through if you end up putting in the correct referring 
domain which is join via the database. Is there another way around this 
?

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php