1 year ago
#252640
TWilliamson
What is the best approach for rejecting HTTP requests that were not generated from my HTML form
I have a Node server that serves a HTML form. The HTML file submits a HTTP post request to the server, before the server extracts the information. Currently, the server assumes the post request comes from the form. If I was to make a request from Postman, with a different body, the server runs into issues as particular fields are not present.
I was about to add a server function that first parses the request's body, to make sure all fields exist before anything is done. This seems like a good idea to do anyway, but I was wondering if any other steps can be done first to validate the request, before the server parses the body as a secondary check.
My ideas: Have the HTML file add a particular header to the request, which is checked by the server. I know that someone could easily copy this, but I believe this would easily deal with bots making random requests. Any other ideas?
http
post
server
request
websecurity
0 Answers
Your Answer