title: How to secure Cross-Domain request; allowing third website to POST data
body: <p>I have done some researches on how to prevent fake cross-origin requests and have found a lot of useful information. However, none of them seems to directly resolve my concerns, and because my application has to deal with this specific situation, I would like to understand it completely.</p>
  
  <p>I have a simple php mailing website: mailsite.com</p>
  
  <p>This site will allow other pre-defined addresses, for instance, user.com, to send POST data to it, and process the information that contains <code>to</code> and <code>mesaage</code>; then send them an E-mail from mailsite.com to <code>to</code> with the message <code>message</code>.</p>
  
  <p>Currently, I am using <code>$_SERVER[ "HTTP_ORIGIN" ]</code> and <code>$_SERVER[ "HTTP_REFERER" ]</code> to check where the requests come from; and process them if it is from the pre-defined domains. However, I've read some articles that say:</p>
  
  <ol>
  <li>HTTP_ORIGIN is not even indexed in PHP documentation, because it is pretty much per-browser sort of thing, so browsers that refuse to send those information will not work. HTTP_REFERER is easy to fake.</li>
  <li>Tokens are good in preventing CSRF.</li>
  </ol>
  
  <p>However, the request I allow is coming from a third pre-defined website, how does Tokens work in this situation?</p>
  
  <p>My question is: If I allow specific domains to POST data to my site, how can I make sure (or the most secured way) that those requests are coming from the sites I expected? Is HTTP_ORIGIN not even safe enough to use? I dare to think about allowing third website to POST data to my site because I've seen Facebook allowing people to access their database. There must be some possible solutions for checking where the requests come from.</p>