php - Allow login to website only if request comes from another specific website -

i have php/mysql website (website 1) has login system asks pin code (just long numeric string). user has 2 ways of login in code:

1. going website 1 login page , enter code in typical login form
2. clicking in website 2 on link carries pin code value. link has format http://myurl.com/login.php?pin=123456789. calls function receives pin parameter , processes login. website 2 located in different domain/server website 1.

until here works fine.

now come's question. know if when using second method described above, if it's possible allow login (assuming pin correct) only if link has been clicked in specific website.

the way works now, link use login website 1. want prevent that, want allow happen if link has been clicked win website 2.

the idea "detect" referring website in login function, , allow if matches url (or other unique identifier) of website 2.

if using "plain" link not allow wouldn't problem, i'm flexible way use this, in end need meant click users in website 2.

edit

i think it's add since of comments/responses talk security of doing (which great of course). main reason "force" users visit website 2 before going website 1. can't enter url in browser , log website 1, want able use link if they're clicking website 2. explain because security not huge factor here, if few savy users can around whatever method implement it's not big deal, it's more important method simple possible implement in website 2 (since don't run website , need ask people there whatever needed).

i think you're looking variation of single sign on. technique in authentication in 1 site recognised transparently in another. here how works in case.

normally have link in site2.com this:

http://site1.com/login.php?pin=123456789

however, site1.com cannot tell referrer site has come from, since it can trivially faked. of course, may not matter use case, if want simple level of security. if want better, read on!

you can use hashing system , shared secret, create can have come 1 source. both sites have same shared secret, stored in file. we'll call $sharedsecret. algorithm goes this:

$hash = hashfunction($pin . $sharedsecret); 

then can in site2.com:

<a     href="http://site1.com/login.php?pin=<?php echo (int) $pin ?>&amp;hash=<?php echo $hash ?>"     alt="authenticated link" > 

when site1.com sees it, can pin straight away, repeat algorithm, , check hash did come site2.com. if have several referring sites, site1.com should store separate secret of them, , can securely check referrer see 1 should load.

the shared secret should substantial enough cannot guessed; tend go around 40-60 characters.

however, remaining flaw in plan visit site2.com , steal link them, , still work, providing willing fake referrer every time wanted access. may therefore useful add timestamp algorithm too:

// time rounded nearest 500 seconds, account // out of sync clocks. adjust depending on how long want links // remain active $time = floor(time() / 500) * 500; $hash = hashfunction($pin . $sharedsecret . $time); 

then on site1.com should compute 2 hashes:

• one floor(time() / 500) * 500
• one floor(time() / 500) * 500 - 500

if supplied hash matches either, allow link unlock content. accounts possibility time went on +/-500 boundary between 1 server , next.

i haven't mentioned specific hashing function here. sha256 should fine, note i'm not cryptographer. if want more security again, may worth checking ensure isn't brute-forcing system flooding system guesses - though on internet hardly worth trying.