title: Forbidding external domain access
body: <p><strong>Question</strong>: I would like to allow only my website's form; <code>&lt;form action="link"</code> to navigate to www.domain.com/link when my form is submitted. But to deny direct access to the URL www.domain.com/link.</p>
  
  <p><strong>Attempt</strong>: So far I know how to forbid access with mod_rewrite:</p>
  
  <pre><code>Options -Multiviews
  RewriteEngine on
  
  RewriteCond %{REQUEST_URI} link
  RewriteRule ^.*/?link/? - [F]
  </code></pre>
  
  <p>But I do not know how to allow a form submit to access the page. I explored the possibility of using a input tag with a secret value to allow access if the form get submitted by doing this</p>
  
  <pre><code>Options -Multiviews
  RewriteEngine on
  
  RewriteCond %{REQUEST_URI} link
  RewriteCond %{QUERY_STRING} !secret_key
  RewriteRule ^.*/?link/? - [F]
  </code></pre>
  
  <p><strong>Alternative</strong>: But a user could just copy and paste that key as a query string whenever they want to access the page directly. And even if I hid the query string using mod_rewrite, a smarter user can still access the page by inspecting the input tags. What is the sure fire way to secure a page like this? Without contaminating the query string.</p>