Protect a form submit cfm page

[nikos101]

How else to I protect a form submit cfm page to make sure the request only comes from pages in my own site?

So far I have this

<cfif Not cgi.REQUEST_METHOD eq "POST">

  <cflocation url="../index.cfm" addtoken="no">

</cfif>

[Owainnorth]

I don't believe you can. You can check the CGI.HTTP_REFERRER value, but that is easily spoofed if someone is looking to post to your page. CFCaptcha might be worth a look though. Care to elaborate on the problem?

[nikos101]

I basically only want people to post here if they have been authenticated users

[Owainnorth]

Then in your application.cfc's onRequestStart() method, you need to check authentication. If they're not authenticated do a redirect to a failure page or return a 403 response. As long as all that happens in onRequestStart(), the page will never be processed.

[Steve Sommers · Accepted solution]

We do the following in our application.cfm:

<cfif isDefined("FORM.fieldNames") and len(FORM.fieldNames) and NOT reFindNoCase("^(http|https)://#CGI.HTTP_HOST#/",CGI.HTTP_REFERER)>

  <cfabort showerror="Forbidden Request - POST request denied.">

</cfif>

[nikos101]

Steve and Owains answers are great!!