HTTP Request Validation

Is there a reliable way to ensure an HTTP request has come from LL servers? How easy is it to spoof the request headers?

It's pretty easy to spoof headers with a php-script...

But then again, you're the one making tha request, so if you enter the correct URL, you can be pretty sure that the response comes from the right server...
Unless someone hacked into the SL-Servers and hijacked their URL...

Yeah, the setup I have is pretty secure -- the URL exists only in a no-mod script, and I've never even publicized the domain name, so the chances of anyone even getting the URL to make a request are slim. Of course, if someone did get it, all they would have to do is write a script in SL to make the request, so even checking that the request comes from LL servers would be no protection. Oh well.

It sure would be nice to have a MD5 function in LSL!

Edit: Erm, nevermind. How on earth did I overlook that all this time?!

Edit 2: OK, no more pre-coffee programming for me. Not only did I know about the function, I've used it before. :igh::

integer HadCoffee;

default
{
    wakeup(integer intTime) {
        while (intTime < 0800) {
            llSleep(3600);
        }

        HadCoffee = FALSE;

        state Programming;
    }
}

state Programming {
    state_entry() {
        if (!HadCoffee) {
            state GetCoffee;
        }
    }
}

state GetCoffee {
    state_entry() {
        integer SerumCaffeine = 0;

        llMakeCoffee();

        while (SerumCaffeine < SIANN_IS_AWAKE) {
            SerumCaffeine+= llDrinkCoffee();
        }

        HadCoffee = TRUE;

        state Programming;
    }
}

Lmao!

The headers are pretty easy to spoof, but there is also a published list of IP ranges for LL's servers. If a connection comes from there AND has the headers, it's a pretty good bet it is from LSL code. The authentication hash is still a good idea though, if any of the communications is critical.

http://wiki.secondlife.com/wiki/Simulator_IP_Addresses

That has always been my rule #1, of course then I do have a rotary burr mill, 18 barr pump driven expresso machine & locally roasted, fresh beans Needless to say, I LOVE coffee!!!!!!!!!!!

Rule#2 I found out the hard way. Never, ever try to answer scripting questions while under the influence of pain pills

I just realized that I actually understood the question wrong... I thought you were asking about HTTP-Requests sent _into_ SL no the ones sent _from_ SL to a webserver...

Adding a hash-value might be a pretty good idea...

... and btw - I had lots of coffee already when I replied... it's not _always_ helpful

My config:

Server: Electro-Stove
OS: (pre-grinded) Chicco d'Oro
Processor: Italian Espresso-Machine (one of these where you put the water in the bottom, the coffee in the middle and put it directly on your stove - blubbers when task is completed
Average input/output: too much