How to see what source is call my website page PHP
I want to know if Its possible to see what resource is calling my website page (PHP file).
I have created an API PHP page which handles JSON POST data and saves it to the DB.
Now I would like to know what resource is calling my PHP page.
As example I'm using POSTMAN to post data to my page.
Is it possible to see that a call came from postman?.
Is that possible to get that information in PHP?
php json api postman
edited Nov 22 '18 at 12:00
Nedko Dimitrov
488515
asked Nov 22 '18 at 11:23
user10663763user10663763
82
add a comment |
I want to know if Its possible to see what resource is calling my website page (PHP file).
I have created an API PHP page which handles JSON POST data and saves it to the DB.
Now I would like to know what resource is calling my PHP page.
As example I'm using POSTMAN to post data to my page.
Is it possible to see that a call came from postman?.
Is that possible to get that information in PHP?
php json api postman
edited Nov 22 '18 at 12:00
Nedko Dimitrov
488515
asked Nov 22 '18 at 11:23
user10663763user10663763
82
2
Check$_SERVERfor all kind of info about request. Just know that it can't be 100% trusted.
– Justinas
Nov 22 '18 at 11:27
2
I think you're referring to user agent?
– marvinIsSacul
Nov 22 '18 at 11:29
I agree with @Justinas. You can check it in $_SERVER. If request is coming from postman then you will find HTTP_POSTMAN_TOKEN and HTTP_X_POSTMAN_INTERCEPTOR_ID keys in $_SERVER.
– Hitesh Shrimali
Nov 22 '18 at 12:13
Postman is just an example, I want to know where the call came from
– user10663763
Nov 22 '18 at 13:33
add a comment |
I want to know if Its possible to see what resource is calling my website page (PHP file).
I have created an API PHP page which handles JSON POST data and saves it to the DB.
Now I would like to know what resource is calling my PHP page.
As example I'm using POSTMAN to post data to my page.
Is it possible to see that a call came from postman?.
Is that possible to get that information in PHP?
php json api postman
edited Nov 22 '18 at 12:00
Nedko Dimitrov
488515
asked Nov 22 '18 at 11:23
user10663763user10663763
82
I want to know if Its possible to see what resource is calling my website page (PHP file).
I have created an API PHP page which handles JSON POST data and saves it to the DB.
Now I would like to know what resource is calling my PHP page.
As example I'm using POSTMAN to post data to my page.
Is it possible to see that a call came from postman?.
Is that possible to get that information in PHP?
php json api postman
php json api postman
edited Nov 22 '18 at 12:00
Nedko Dimitrov
488515
asked Nov 22 '18 at 11:23
user10663763user10663763
82
edited Nov 22 '18 at 12:00
Nedko Dimitrov
488515
asked Nov 22 '18 at 11:23
user10663763user10663763
82
edited Nov 22 '18 at 12:00
Nedko Dimitrov
488515
edited Nov 22 '18 at 12:00
Nedko Dimitrov
488515
edited Nov 22 '18 at 12:00
Nedko Dimitrov
488515
488515
asked Nov 22 '18 at 11:23
user10663763user10663763
82
asked Nov 22 '18 at 11:23
user10663763user10663763
82
asked Nov 22 '18 at 11:23
user10663763user10663763
82
82
2
Check$_SERVERfor all kind of info about request. Just know that it can't be 100% trusted.
– Justinas
Nov 22 '18 at 11:27
2
I think you're referring to user agent?
– marvinIsSacul
Nov 22 '18 at 11:29
I agree with @Justinas. You can check it in $_SERVER. If request is coming from postman then you will find HTTP_POSTMAN_TOKEN and HTTP_X_POSTMAN_INTERCEPTOR_ID keys in $_SERVER.
– Hitesh Shrimali
Nov 22 '18 at 12:13
Postman is just an example, I want to know where the call came from
– user10663763
Nov 22 '18 at 13:33
add a comment |
2
Check$_SERVERfor all kind of info about request. Just know that it can't be 100% trusted.
– Justinas
Nov 22 '18 at 11:27
2
I think you're referring to user agent?
– marvinIsSacul
Nov 22 '18 at 11:29
I agree with @Justinas. You can check it in $_SERVER. If request is coming from postman then you will find HTTP_POSTMAN_TOKEN and HTTP_X_POSTMAN_INTERCEPTOR_ID keys in $_SERVER.
– Hitesh Shrimali
Nov 22 '18 at 12:13
Postman is just an example, I want to know where the call came from
– user10663763
Nov 22 '18 at 13:33
2
2
Check
$_SERVER for all kind of info about request. Just know that it can't be 100% trusted.– Justinas
Nov 22 '18 at 11:27
Check
$_SERVER for all kind of info about request. Just know that it can't be 100% trusted.– Justinas
Nov 22 '18 at 11:27
2
2
I think you're referring to user agent?
– marvinIsSacul
Nov 22 '18 at 11:29
I think you're referring to user agent?
– marvinIsSacul
Nov 22 '18 at 11:29
I agree with @Justinas. You can check it in $_SERVER. If request is coming from postman then you will find HTTP_POSTMAN_TOKEN and HTTP_X_POSTMAN_INTERCEPTOR_ID keys in $_SERVER.
– Hitesh Shrimali
Nov 22 '18 at 12:13
I agree with @Justinas. You can check it in $_SERVER. If request is coming from postman then you will find HTTP_POSTMAN_TOKEN and HTTP_X_POSTMAN_INTERCEPTOR_ID keys in $_SERVER.
– Hitesh Shrimali
Nov 22 '18 at 12:13
Postman is just an example, I want to know where the call came from
– user10663763
Nov 22 '18 at 13:33
Postman is just an example, I want to know where the call came from
– user10663763
Nov 22 '18 at 13:33
add a comment |
1 Answer
1
active
oldest
votes
You can know some things about the request, for example:
1) IP address:
// Read the IP from who is really making the request (a user or a proxy)
$ipAddress = $_SERVER['REMOTE_ADDR'];
// Read the IP that the proxy is telling us making the request.
$ipAddress = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : '';
If the source of the request is behind a proxy, $_SERVER['REMOTE_ADDR'] will have the IP of the proxy, so you can check the HTTP_X_FORWARDED_FOR header but can be easily spoofed, unless you have control of the proxy or is a trusted proxy.
2) User Agent:
// Using global $_SERVER
$userAgent = $_SERVER['HTTP_USER_AGENT'];
// Using get_browser function you can get an array with the information
$arrayBrowserInfo = get_browser($userAgent, true);
The User Agent is easily spoofed too, so you can't trust it's the correct one.
3) Referer:
$referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
The referer header is optional and no many browsers send to the XHR Requests.
If you are building an API, depending the use case may you can ask for a mandatory header or parameter in order to tell you more information of who is doing the request (Android App, iOS App, Website, etc.) Obviously, that can be easily spoofed.
So i don't recommend that using for security validations, but if you only want to know in order to log the calls for debug, may be useful.
answered Nov 22 '18 at 21:31
Leandro FerreroLeandro Ferrero
734
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53429885%2fhow-to-see-what-source-is-call-my-website-page-php%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You can know some things about the request, for example:
1) IP address:
// Read the IP from who is really making the request (a user or a proxy)
$ipAddress = $_SERVER['REMOTE_ADDR'];
// Read the IP that the proxy is telling us making the request.
$ipAddress = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : '';
If the source of the request is behind a proxy, $_SERVER['REMOTE_ADDR'] will have the IP of the proxy, so you can check the HTTP_X_FORWARDED_FOR header but can be easily spoofed, unless you have control of the proxy or is a trusted proxy.
2) User Agent:
// Using global $_SERVER
$userAgent = $_SERVER['HTTP_USER_AGENT'];
// Using get_browser function you can get an array with the information
$arrayBrowserInfo = get_browser($userAgent, true);
The User Agent is easily spoofed too, so you can't trust it's the correct one.
3) Referer:
$referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
The referer header is optional and no many browsers send to the XHR Requests.
If you are building an API, depending the use case may you can ask for a mandatory header or parameter in order to tell you more information of who is doing the request (Android App, iOS App, Website, etc.) Obviously, that can be easily spoofed.
So i don't recommend that using for security validations, but if you only want to know in order to log the calls for debug, may be useful.
answered Nov 22 '18 at 21:31
Leandro FerreroLeandro Ferrero
734
add a comment |
You can know some things about the request, for example:
1) IP address:
// Read the IP from who is really making the request (a user or a proxy)
$ipAddress = $_SERVER['REMOTE_ADDR'];
// Read the IP that the proxy is telling us making the request.
$ipAddress = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : '';
If the source of the request is behind a proxy, $_SERVER['REMOTE_ADDR'] will have the IP of the proxy, so you can check the HTTP_X_FORWARDED_FOR header but can be easily spoofed, unless you have control of the proxy or is a trusted proxy.
2) User Agent:
// Using global $_SERVER
$userAgent = $_SERVER['HTTP_USER_AGENT'];
// Using get_browser function you can get an array with the information
$arrayBrowserInfo = get_browser($userAgent, true);
The User Agent is easily spoofed too, so you can't trust it's the correct one.
3) Referer:
$referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
The referer header is optional and no many browsers send to the XHR Requests.
If you are building an API, depending the use case may you can ask for a mandatory header or parameter in order to tell you more information of who is doing the request (Android App, iOS App, Website, etc.) Obviously, that can be easily spoofed.
So i don't recommend that using for security validations, but if you only want to know in order to log the calls for debug, may be useful.
answered Nov 22 '18 at 21:31
Leandro FerreroLeandro Ferrero
734
add a comment |
You can know some things about the request, for example:
1) IP address:
// Read the IP from who is really making the request (a user or a proxy)
$ipAddress = $_SERVER['REMOTE_ADDR'];
// Read the IP that the proxy is telling us making the request.
$ipAddress = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : '';
If the source of the request is behind a proxy, $_SERVER['REMOTE_ADDR'] will have the IP of the proxy, so you can check the HTTP_X_FORWARDED_FOR header but can be easily spoofed, unless you have control of the proxy or is a trusted proxy.
2) User Agent:
// Using global $_SERVER
$userAgent = $_SERVER['HTTP_USER_AGENT'];
// Using get_browser function you can get an array with the information
$arrayBrowserInfo = get_browser($userAgent, true);
The User Agent is easily spoofed too, so you can't trust it's the correct one.
3) Referer:
$referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
The referer header is optional and no many browsers send to the XHR Requests.
If you are building an API, depending the use case may you can ask for a mandatory header or parameter in order to tell you more information of who is doing the request (Android App, iOS App, Website, etc.) Obviously, that can be easily spoofed.
So i don't recommend that using for security validations, but if you only want to know in order to log the calls for debug, may be useful.
answered Nov 22 '18 at 21:31
Leandro FerreroLeandro Ferrero
734
You can know some things about the request, for example:
1) IP address:
// Read the IP from who is really making the request (a user or a proxy)
$ipAddress = $_SERVER['REMOTE_ADDR'];
// Read the IP that the proxy is telling us making the request.
$ipAddress = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : '';
If the source of the request is behind a proxy, $_SERVER['REMOTE_ADDR'] will have the IP of the proxy, so you can check the HTTP_X_FORWARDED_FOR header but can be easily spoofed, unless you have control of the proxy or is a trusted proxy.
2) User Agent:
// Using global $_SERVER
$userAgent = $_SERVER['HTTP_USER_AGENT'];
// Using get_browser function you can get an array with the information
$arrayBrowserInfo = get_browser($userAgent, true);
The User Agent is easily spoofed too, so you can't trust it's the correct one.
3) Referer:
$referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
The referer header is optional and no many browsers send to the XHR Requests.
If you are building an API, depending the use case may you can ask for a mandatory header or parameter in order to tell you more information of who is doing the request (Android App, iOS App, Website, etc.) Obviously, that can be easily spoofed.
So i don't recommend that using for security validations, but if you only want to know in order to log the calls for debug, may be useful.
answered Nov 22 '18 at 21:31
Leandro FerreroLeandro Ferrero
734
answered Nov 22 '18 at 21:31
Leandro FerreroLeandro Ferrero
734
answered Nov 22 '18 at 21:31
Leandro FerreroLeandro Ferrero
734
answered Nov 22 '18 at 21:31
Leandro FerreroLeandro Ferrero
734
734
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53429885%2fhow-to-see-what-source-is-call-my-website-page-php%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
Check
$_SERVERfor all kind of info about request. Just know that it can't be 100% trusted.– Justinas
Nov 22 '18 at 11:27
2
I think you're referring to user agent?
– marvinIsSacul
Nov 22 '18 at 11:29
I agree with @Justinas. You can check it in $_SERVER. If request is coming from postman then you will find HTTP_POSTMAN_TOKEN and HTTP_X_POSTMAN_INTERCEPTOR_ID keys in $_SERVER.
– Hitesh Shrimali
Nov 22 '18 at 12:13
Postman is just an example, I want to know where the call came from
– user10663763
Nov 22 '18 at 13:33