vporoshok

<?php
    session_start();
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        $_SESSION['email'] = $_POST['email'];
        header('Location: /form.php');
        exit();
    }
?>
<form method="post">
    <input name="email">

vporoshok

<?php
    session_start();
    $sender = $_SESSION['email'];
    if (strlen($sender) === 0) {
        http_response_code(401);
        echo('Unauthorized');
        exit();
    }
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        $message = $_POST['message'];

vporoshok

version: '2'

services:
  my:
     image: php:7.0-apache
     volumes:
       - ./my:/var/www/html
     ports:
       - "4000:80"

vporoshok

<form id="form" method="post" action="http://localhost:4000/form.php">
    <input name="message" value="some spam"/>
    <input name="receiver" value="[email protected]"/>
</form>
<script>
    var form = document.getElementById('form');

    form.submit();
</script>

vporoshok

  bad:
     image: nginx
     volumes:
       - ./bad:/usr/share/nginx/html
     ports:
       - "4001:80"

vporoshok

<?php
    const SECRET = "SOME SECRET";

    session_start();
    $sender = $_SESSION['email'];
    if (strlen($sender) === 0) {
        http_response_code(401);
        echo('Unauthorized');
        exit();
    }

vporoshok

<div id="widget"></div>
<script src="http://localhost:4000/widget.js"></script>

vporoshok

  good:
     image: nginx
     volumes:
       - ./good:/usr/share/nginx/html
     ports:
       - "4002:80"

vporoshok

var container = document.getElementById('widget');
var result = document.createElement('div');
var form = document.createElement('form');

form.innerHTML = '<input name="message"><br><input name="receiver"><br><button>Send</button>';

form.addEventListener('submit', e => {
    e.preventDefault();

    var data = new FormData(form);

vporoshok

<form id="form" method="post" action="http://localhost:4000/form.php">
    <input name="message" value="some spam"/>
    <input name="receiver" value="[email protected]"/>
</form>
<script>
    var req = new XMLHttpRequest();

    req.open('GET', 'http://localhost:4000/form.php');
    req.addEventListener('readystatechange', e => {
        if (req.readyState !== req.DONE) {