How to prevent access to web app that is intended for embedding?

Question

I have a web app http://embed.myapp.com that is intended to be embedded on a few whitelisted sites. The frame access is controlled with X-Frame-Options ALLOW-FROM

However, I do not want users to access it by putting in the above link directly in the web browser.

What is the best way to block plain (non-embedded) access?

I can determine whether the site is embedded with javascript, but by that point a session is already created and certain sensitive information such as CSRF tokens can be seen.

Answer 1

You may not quite get an absolutely foolproof way of stopping users from looking at the content directly.

A simple way to catch most cases would be to look at the referer header ( http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html section 14.36) on the server side and only serve the content when it is referred from the correct pages.