Better way to get where a request actually came from
<p>I am aware that <code>$_SERVER[REFERRER]</code> can be used to detect where a request comes from however it turned out that it can be fooled or even a browser might not send it as part of the request.</p>

<p>Could anyone suggest a better way to detect or rather allow requests from own domain only to avoid spoofing, DoS, etc security attacks?</p>
