I want to have one application, that serves javascript code performing stuff such as cookies management or run validation and so on and other website, that includes this code. The thing is, the script should perform GET and POST on the server and should somehow authenticate itself. For example when user accepts cookie form, this consent should be sent to the server so it could be stored as a proof to our authorities, but every website will have different users and I want to identify them for each website. Also, there should't be a way of forging the requests leading to false data. This should go as follows:
server.com provides javascript and database of consents.
User goes to example.com that has this javascript included.
User clicks accept.
Website sends this information to server.com
Server.com checks, if the request was really sent by example.com and writes to db.
Everyone is happy.
It could work somehow like google analytics identifies the website? (Don't know how) I've spent too much time googling and going through source codes and couldn't find anything.
EDIT: I was thinking of taking advantage of CORS. Site will send request to server and it will respond with some token and set Access-Control-Allow-Origin and the site will now on use this token, that will be valid only for a certain period of time, maybe usage count limited. Would this be reasonable solution? Could this be somehow forged?