I want to run this by the group to get some ideas on how to improve security.

Long story short, I have a web app that when you send an email to [email protected], using php and imap, the script checks the email account and then saves that email into mysql to be used for other parts of the application. We take all necessary steps to properly sanitize the data to prevent mysql injections etc.

However, In order for the incoming email to be saved into mysql, your email address has to be approved first as to not allow just anyone to have their email saved into our database.

My question is, if a hacker wanted to, they could mask the "from" email address of an approved user and if they found out our secret email address to send to, they could then have their messages saved to our database, bypassing our security measures. Is there any way to prevent this?

For instance, let's say that an approved email is [email protected]. Is there a way to check with PHP if that the email sent to our mail server actually came from [email protected] or was it masked?

I have looked at gethostbyname() , but not exactly sure how to implement it while not creating a bunch of headaches for our legit users.

Any ideas would be much appreciated, thanks!

CodePudding user response：

There is no simple way to verify that a From: header is legitimate. There are methods that can help increase confidence in it, though:

• SPF records can be used to check that the originating server is authorized to send for that domain, though this won't help with the "local-part", or the individual sending.
• DKIM signing can indicate that the actual address used is authorized by that server, something often included by default on most email platforms (e.g. Gmail).

Unless you do additional work to verify these headers you've got no way of knowing.

If you're expecting email from an unsigned source, with no SPF records, it's anyone's guess as to if that's legitimate or not.

This is why you'll often see services with a "mail in" end point use obfuscated delivery addresses, that is a secret address of sorts that can be used to communicate with the app or service. For example, Evernote uses this approach, giving a unique destination email for each user.

This provides at least a layer of security in that unless that address is leaked out, it's highly unlikely that some attacker could exploit that address. Anything sent there is probably from the authorized individual.