I have a Rails 3 site in which I've rolled my own user authentication.
I'm now in the process of integrating a 3rd party service (Fotomoto) that gets called with javascript on certain pages and needs to reach out from their serves to pull content from that page. How do I effectively whitelist requests from a certain domain *.fotomoto.com.
I would like to simply add some code to my before_filter that is smart enough to look at the requestor and determine whether it came from that domain. Fotomoto tells you how to allow their access at an Apache http level, but I only want to grant them access to certain controller actions.
def my_before_filter
unauthorized_access unless signed_in? || request.remote_ip == ??? #check against *.fotomoto.com
end
And it seems like ideally I would be consulting a DNS server I trust. I'm hosting with Heroku if that matters.