How to let users send to a link

Question

I'm building for a client's service that allows developers to build client side forms, similar to formspree.io, etc. Basically, developers can set an action to their HTML forms which send the POST data to my service. However, I need a way to authenticate requests.

Formspree does it like: <form action="https://formspree.io/your@email.com" method="POST">.

But the client wants to charge per request. So I need a way to make sure that when XYZ.company puts a form on their website, only the requests THEY actually make are charged.

I'm thinking I could issue out a key, have the users server encrypt it somehow, and then generate a random link?

Ideas?

Answer 1

A couple ideas come to mind... I'm not sure what language you are using, but on your server you can check the referring URL, and only accept requests that match whatever domain(s) are valid.

However, I believe referring URL headers can be spoofed pretty easily. You can still do it, because valid requests will have it and it will probably mitigate some threats.

A second idea I have is to (for each domain that is valid) issue some type of secret key that your client keeps server-side only. When their page with the form loads, it calls (server-side) a service that you have, and passes in the secret key, and you validate if it's valid; if so, you send back a generated token and store it in a database. This token should be passed into your view and put into the form somehow.

The token should be for 1-time use only. Maybe store the user's IP address and/or an expiration date on your side, and when the form submits you will be able to validate the token is valid (which came from you in the first place), it's not past the expiration, and the form submission is coming from the same place it originated from. Delete the token in your database after it is used for a form submission.