How do I make a service only runable by the server?

Question

I've created an action that calls a service. The action will be called by a cron task. I want to set this up so that ONLY the cron task can call the action. It's important that it can not be run by any other means (via HTTP, CURL request etc.).

Any ideas on how to do that?

UPDATED (I think this will work):

public function actionMethod() 
{
    $this->requireAjaxRequest();

    $key = craft()->request->getParam('key');

    if($key == 'random-string' && $_SERVER['REMOTE_ADDR'] == 'my-servers-ip-address') {
        craft()->plugin_name->actionMethod();
    }

}

Note, this is twinned with a cron tab that looks like: curl -H "X-Requested-With: XMLHttpRequest" http://sitename.co.uk/actions/plugin_name/Method?key=random-string

Answer 1

Have your cron job pass in a super-duper top-secret key via the querystring.

yoursite.com/actions/pluginHandle/pluginAction?key=youwillneverguessme

You can use a site like www.guidgen.com to generate the key.

Then just have your action check for that key, make sure it matches and bail if it doesn't.

Answer 2

Along with Brad's answer, one additional easy check in your code would be to see if the $_SERVER['REMOTE_ADDR'] is the server's IP and then bail if it's not.

That means you'd have to spoof the server's IP address AND guess the key. No better than a username/password combination but should be secure enough IMO.