Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17012

Re: Preventing bombing

Show key headers only | View raw

bit-naughty@hotmail.com writes:

> If I have a site where people will log in and make posts, what's to
> stop someone logging in manually, ie. with the password they've signed
> up to the site with, and THEN running the bombing script to fill up
> the database with junk?
> I suppose Apache can be configged to prevent too many posts from 1 IP
> in too little time (is this done by default?), but this is not really
> a solution.
>
> I would really hate to put Capchas in my site for *each time people
> wanna post something* - this is really a horrible thing to do to my
> users. Is there a solution?

I would implement a cryptographically protected timer and serial number
(a UUID works as well).  You can use the serial number to reject
repeated submissions of the same form, and the time to reject forms that
are requested and submitted either too fast (because a bot has filled
them in) or too slowly (a bot has cached the form a queued the
submission).

If you are only interested preventing scripts that just send the form
data again and again, you need only the serial number.  Of course you
need to store it, but if your users' posts are being stored in a
database, it's very simple to check if a post with the number has been
seen so before.

To defeat the very simplest scripts, you don't even need the
cryptographic check, but it's simple to implement so I'd do it anyway.
Whatever check data you send out with the form, append some random data
to it and hash it with a key know only to the server.  That way you can
reject any submission where the script has guessed that the serial
number must be changed or the time code is important.

The timer part can be made minimally intrusive to the user.  If they
submit the form really quickly, or they take too long, just re-send it
along with a time code that will be accepted right away and tell them to
click again.

-- 
Ben.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Preventing bombing bit-naughty@hotmail.com - 2016-09-05 23:28 -0700
  Re: Preventing bombing Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-09-06 14:16 +0100
  Re: Preventing bombing gordonb.7fqba@burditt.org (Gordon Burditt) - 2016-09-06 14:28 -0500
  Re: Preventing bombing "J.O. Aho" <user@example.net> - 2016-09-07 07:04 +0200
  Re: Preventing bombing bit-naughty@hotmail.com - 2016-09-07 00:55 -0700
    Re: Preventing bombing "R.Wieser" <address@not.available> - 2016-09-07 10:23 +0200

csiph-web