Answers.Body: <p>Have your cron job pass in a super-duper top-secret key via the querystring.</p>
  
  <pre><code>yoursite.com/actions/pluginHandle/pluginAction?key=youwillneverguessme
  </code></pre>
  
  <p>You can use a site like <a href="http://www.guidgen.com/" rel="nofollow">www.guidgen.com</a> to generate the key.</p>
  
  <p>Then just have your action check for that key, make sure it matches and bail if it doesn't.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-19T17:44:38.347Z
Answers.Text: Thanks Brad, does my updated question look like it would work to you?
Answers.UserDisplayName: H2ONOCK
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-19T17:50:17.867Z
Answers.Text: Looks good to me!
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-19T16:26:10.327Z
Answers.LastActivityDate: 2015-11-19T16:26:10.327Z
Answers.UserDisplayName: Brad Bell
Answers.Body: <p>Along with Brad's answer, one additional easy check in your code would be to see if the <code>$_SERVER['REMOTE_ADDR']</code> is the server's IP and then bail if it's not.</p>
  
  <p>That means you'd have to spoof the server's IP address AND guess the key. No better than a username/password combination but should be secure enough IMO.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-19T16:35:12.010Z
Answers.LastActivityDate: 2015-11-19T16:35:12.010Z
Answers.UserDisplayName: RitterKnight
Body: <p>I've created an action that calls a service. The action will be called by a cron task. I want to set this up so that ONLY the cron task can call the action. It's important that it can not be run by any other means (via HTTP, CURL request etc.).</p>
  
  <p>Any ideas on how to do that?</p>
  
  <p>UPDATED (I think this will work):</p>
  
  <pre><code>public function actionMethod() 
  {
      $this-&gt;requireAjaxRequest();
  
      $key = craft()-&gt;request-&gt;getParam('key');
  
      if($key == 'random-string' &amp;&amp; $_SERVER['REMOTE_ADDR'] == 'my-servers-ip-address') {
          craft()-&gt;plugin_name-&gt;actionMethod();
      }
  
  }
  </code></pre>
  
  <p>Note, this is twinned with a cron tab that looks like:
  <code>curl -H "X-Requested-With: XMLHttpRequest" http://sitename.co.uk/actions/plugin_name/Method?key=random-string</code></p>
  
Tags: <services><cron>
Title: How do I make a service only runable by the server?
ThreadText: # How do I make a service only runable by the server?
  
  (Asked by: username_0 on 2015-11-19)
  
  I've created an action that calls a service. The action will be called by a cron task. I want to set this up so that ONLY the cron task can call the action. It's important that it can not be run by any other means (via HTTP, CURL request etc.).
  
  Any ideas on how to do that?
  
  UPDATED (I think this will work):
  
  ```
  public function actionMethod() 
  {
      $this->requireAjaxRequest();
  
      $key = craft()->request->getParam('key');
  
      if($key == 'random-string' && $_SERVER['REMOTE_ADDR'] == 'my-servers-ip-address') {
          craft()->plugin_name->actionMethod();
      }
  
  }
  
  ```
  
  Note, this is twinned with a cron tab that looks like:
  `curl -H "X-Requested-With: XMLHttpRequest" http://sitename.co.uk/actions/plugin_name/Method?key=random-string`
  
  **Tags:** services, cron
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2015-11-19. Score: 0 | Accepted answer
  
  Have your cron job pass in a super-duper top-secret key via the querystring.
  
  ```
  yoursite.com/actions/pluginHandle/pluginAction?key=youwillneverguessme
  
  ```
  
  You can use a site like [www.guidgen.com](http://www.guidgen.com/) to generate the key.
  
  Then just have your action check for that key, make sure it matches and bail if it doesn't.
  
  > **Comments:**
  > **username_0**: Thanks username_1, does my updated question look like it would work to you?  
  > **username_1**: Looks good to me!  
  
  ---
  
  ### Answer by username_2 on 2015-11-19. Score: 1
  
  Along with username_1's answer, one additional easy check in your code would be to see if the `$_SERVER['REMOTE_ADDR']` is the server's IP and then bail if it's not.
  
  That means you'd have to spoof the server's IP address AND guess the key. No better than a username/password combination but should be secure enough IMO.
  
  
  ---
  
  