I can think of a couple of ways. You could just keep a database table of allowed urls, but now your proxy has to do a database lookup (which may or may not be an issue). I was thinking of creating a hash of the url and a secret and including that as a parameter, then the proxy can use that to check. But a problem with that scheme is that you can't "revoke" one once it's out there.
|