Disallowing POST requests from different origins GAE

Question

Is it possible to stop requests (POSTs) from different origins on Google App Engine? I understand that IP spoofing is "easy", is there another solution, maybe sessions? Suggestions are welcome.

Answer 1

Not entirely sure from your wording if this is the answer you're after, but you can get the referrer page using the following:

    #Get referring page
    referer = self.request.environ['HTTP_REFERER'] \
              if 'HTTP_REFERER' in self.request.environ else  None

You can then use regex to decided whether to process the request further. Source: http://blog.andrewhays.net/how-to-get-the-referer-url-from-google-appeng

Answer 2

Assuming this is PHP, just check $_SERVER['REMOTE_ADDR'] for the IP/$_SERVER['REMOTE_HOST'] for host they are connecting from. For your specific question though, I would reccomend creating a SESSION variable for when data is submitted it can be checked by the server to verify its source. You can read more on it here.

Hope this helps and DFTBA. :)