: POST attack on my website I have a site (humanisms.co.uk) which incorporates a voting system, ie. user clicks "Up" and it sends a parameter to a PHP script via AJAX, the PHP inserts vote into

@Si4351233

The entire votes control can be injected with a javascript, so it's not part of the html source on your page. In order to boost 'security' and lessen the chance of abuse by automation you could


activate it's 'onclick' event only if you detect mouse moves within a range of that control.
within the server side script check for presence of a url referrer (at least the domain)
you can even calculate a hash of your 'caller' javascript method and send it in a disguised form to the 'voting' control to check if the 'onclick' has indeed originated from within your own script (the hash would be different within various browsers)


Etc.. But main starting point is to have the entire control injected with a javascript. This way it will also contribute to your Text/to HTML ratio on the page, as you'll have less crap within page content that a search engine sees (while it does not see the javascript)

And this way there is no need in using those dumb 'captchas' and claim your visitor's precious time by having them to prove they're not a robot...

Vote Up Vote Down

@Pope3001725

From this question:


You could do several things including:

Use a CAPATCHA like reCAPTCHA

Use a field that requires the user
to answer a question like what is 5 +
3. Any human can answer it but a bot won't know what to do since it is
auto-populating fields based on field
names. So that field will be either
incorrect or missing in which case the
submission will be rejected.

Use a token and put it into a
session and also add it to the form.
If the token is not submitted with the
form or doesn't match then it is
automated and can be ignored.

Look for repeated submissions from
the same IP address. If your form
shouldn't get too many requests but
suddenly is it probably is being hit
by a bot and you should consider
temporarily blocking the IP address.

Vote Up Vote Down

@XinRu657

Log IPs, 1 vote per IP only
CAPTCHCA
Use built in server side script functionality to ensure post request originated from same server

Vote Up Vote Down