title: PHP - Alternative to HTTP_REFERER for gathering requesting domain?
body: <p>I have a simple tracking pixel, used for verifying user accounts:</p>
  
  <pre><code>&lt;?php
      header('Content-Type: image/gif');
      readfile('trackingpixel.gif');
  
      if(isset($_GET['a'])){
          ... stuff
      }
  
      if(isset($_GET['b'])){
          ... stuff
      }
  
      if(isset($_GET['c'])){
          ... stuff
      }       
  
      $requesting = $_SERVER['HTTP_REFERER'];
  
      ... If requesting matches value stored in db, and a/b/c are all good, do stuff
  ?&gt;
  </code></pre>
  
  <p>which is accessed via:</p>
  
  <pre><code>&lt;img src="http://thisismydomain.com/trackingpixel.php?a=...&amp;b=...&amp;c=..." /&gt;
  </code></pre>
  
  <p>And it <em>usually</em> works, as expected. </p>
  
  <p>The idea is that some users have their own domains, and want to "Claim" them, and verify that they are the true owners. We have other options for verification (i.e. META tags), but this is the simplest, for the most basic users - just copy and paste the transparent image, and Bob's your auntie.</p>
  
  <p>The only <code>$_SERVER</code> variable that contains the requesting domain is <code>HTTP_REFERER</code>, but even the simplest Google search will return lots of articles discussing the unreliability, and easy-spoofability, of the value.</p>
  
  <p>Directly <a href="http://php.net/manual/en/reserved.variables.server.php" rel="nofollow">from PHP.NET</a></p>
  
  <blockquote>
    <p>'HTTP_REFERER' </p>
    
    <p>The address of the page (if any) which referred the
    user agent to the current page. This is set by the user agent. Not all
    user agents will set this, and some provide the ability to modify
    HTTP_REFERER as a feature. In short, it cannot really be trusted.</p>
  </blockquote>
  
  <p>And there are myriad SO posts discussing the same.</p>
  
  <p>As it stands, a semi-competent computer monkey could spoof their incorrect domain to display as the correct one, and then put the <code>&lt;img&gt;</code> on their page. My PHP script would think everything was honkey-dory, and pass all conditions.</p>
  
  <p>No bueno! Pas bien!</p>
  
  <p>Is there an alternative to <code>HTTP_REFERER</code>, that I can use to verify the requesting domain? Something that is safe, and preferably required?</p>