OK so server-side security is not my forte. Basically, I'm building a service which users may use (via an SDK) only on the domain they stipulated when they signed up.

The SDK calls my web service over cURL in PHP.

Would I be right in thinking I cannot reliably detect the caller domain, i.e. enforce that it is the same domain they stipulated when signing up?

cURL of course sends this over headers, but headers can always (?) be faked.

Is there a better course of action to enforce domain for this sort of thing?

(NB I'm already using an API key, too - it's just I wanted to restrict domain, too)

Thanks in advance


Question: Looking for advanced GeoServer tutorials
Answer: Although it is a 'quickstart' and may not qualify as more complex information, I found this quite thorough and useful, it uses the geoserver installation on the osgeolive image/bootable disk. I use the virtual machine with the free VMware Player:

http://live.osgeo.org/en/quickstart/geoserver_quickstart.html