I have a flash form with some fields embeded on a cfm page. After the user fills the form, the flash posts the data internally to a coldfusion page. The cfm action page writes a record into the database.
But people who knows how to find http header information, can spam my cfm action page from outside the domain. Because they can find out what variables are being passed and to what page.
What is a good way to make sure that I allow only the post operation from my domain and not from outside my domain. I was thinking of using cgi.http_referer. But a lot of people say that it's not reliable
How should I start tightening this?
Tx in advance
Start Free Trial
