Member Avatar for kgizo

Hello

I've got a problem whereby I need to block access to my survey, I do not want a situation where a user can access the survey by just entering the URL of the survey, the survey has been integrated with mediawiki.

Thanks in advance
kgizo

  • 3 Contributors
  • 4 Replies
  • 351 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by almostbob

Dani AI

Generated

A few practical options that are safer and more reliable than letting a raw URL control access. 's hashing idea can work if the hash is a short-lived, server-side signature instead of a plain MD5 of a public value; 's session suggestion is the simplest when the survey and the linking page share the same session. Two recommended patterns follow (both assume HTTPS and that the survey script runs under the same domain or can verify the signature).

Session-based (simple, same-browser only)

session_start();
// on the wiki/linking page
$token = bin2hex(random_bytes(16));
$_SESSION['survey_token'] = $token;
echo '<a href="/survey.php?token='.$token.'">Take survey</a>';

// on survey.php
session_start();
if (empty($_GET['token']) || !isset($_SESSION['survey_token']) || $_GET['token'] !== $_SESSION['survey_token']) {
  header('HTTP/1.1 403 Forbidden'); exit('Access denied');
}
unset($_SESSION['survey_token']); // make it one-time

Signed URL (stateless, can work across domains)

$secret = 'long_server_side_secret';
$data = $surveyId . '|' . (time() + 300); // includes expiry
$sig  = hash_hmac('sha256', $data, $secret);
$url  = "/survey.php?d=" . urlencode($data) . "&s=" . $sig;

On survey.php recompute hash_hmac('sha256', $d, $secret), verify signature and expiry. This is much stronger than a raw MD5; MD5 is not suitable for tamper-proof signatures.

Cautions and tips

  • Do not rely on HTTP_REFERER — it is spoofable.
  • Tokens in GET are exposed in logs and referers; prefer POST or session for final submission.
  • Set no-cache headers and short expiry for tokens.
  • If access should be limited to wiki users, gate the survey with the wiki authentication/session (check the logged-in user on the server side) rather than public URLs.
  • Test edge cases: multiple tabs, expired tokens, and mixed domains.

These approaches address direct URL entry while keeping links usable from the intended flow.

Recommended Answers

All 4 Replies

Member Avatar for kgizo

Thats what I meant sorry.

Member Avatar for rajdevsohail

It can be easily done .. For example , your web page address is you can hash the value of blahblah by using

$survey = "Anything" ; $hashed_survey = md5($survey);

and then continue your document by replacing blahblah with $hashed_survey ..

Member Avatar for kgizo

thanks rajdevsohail

I'll try it out just now

Member Avatar for almostbob

any of an unlimited number of $session variables set in the page you wish to link from, search for in the page you wish to land on

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.