在 ASP.NET 中嗅探 XMLHttpRequest（浏览器嗅探 AJAX 请求）的可靠方法？
我想在我的应用程序中添加一个额外的障碍，以防止通过 javascript 实现自动化，特别是当自动化请求是通过来自任何流行浏览器的 XMLHttpRequest 完成时。
是否有可以在 ASP.NET 中使用的 XMLHttpRequest 的可靠标志？
我想另一个相关问题是，XMLHttpRequest 很难看起来是一个普通的人类驱动的请求吗？ 因为如果是的话，那么我想我是在做傻事。
更新：我可能把这个问题表述得太狭隘了。 目标是检测：由其他人编写的代码，不是由普通浏览器提交的，可能是机器人，可能不是来自我的 Intranet 客户，等等。到目前为止，我想到的是 XHR 和 .NET WebRequest 请求。
I want to add an additional roadblock in my application to prevent automating it via javascript, specifically when the automated requests are being done via XMLHttpRequest from any of the popular browsers.
Is there a reliable tell-tale sign of a XMLHttpRequest that I can use in ASP.NET?
And I guess the other related question is, is it hard for XMLHttpRequest to appear to be an ordinary human driven request? Because if it is, then I guess I'm on fools errand.
UPDATE: I might be phrasing the question too narrowly. The goal is to detect : code written by someone else, not submitted by a ordinary browser, might be a bot, might not be from a my intranet customers, etc. So far XHR and .NET WebRequest requests come to mind.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
您始终可以使用验证码来确保有人负责提交请求。 recaptcha.net 是免费的，有助于书籍数字化。
编辑：
如果您知道要阻止什么类型的恶意行为，则可以开发简单的算法来检测该行为。 当检测到这种行为时，您可以使用验证码向客户端发起挑战，以确保有人对此负责。 这种方法开始成为普遍做法。 查看关于此主题的帖子。
You could always use a CAPTCHA to ensure that a human is responsible for submitting the request. recaptcha.net is free and helps to digitize books.
Edit:
If you know what type of malicious behavior you are trying to prevent, you could develop simple algorithms for detecting that behavior. When that behavior is detected you could challenge the client with a CAPTCHA to ensure that a human is responsible. This approach is starting to become common practice. Take a look at this post on this topic.
不，没有办法做到这一点。 许多流行的库（例如 jquery）都放置了一个特殊的标头（jquery 为“x-requested-with”）来指示它是 ajax 调用，但这显然是客户端自愿的。
不幸的是，您必须假设您收到的任何请求都可能是恶意的
no, there is no way of doing this. a lot of the popular libraries like jquery put a special header ("x-requested-with" for jquery) to indicate it's an ajax call, but that's obviously voluntary on the part of the client.
you must assume that any request you receive may be malicious unfortunately
你可以做一些偷偷摸摸的事情，但不幸的是这并不能阻止所有人。 例如，您可以将一些 JavaScript 放置在加载页面时运行的开始/登录页面上。 此 JavaScript 会导致重定向，并可能写入一个加密的 cookie 值，该值会发送回服务器。 使用 XMLHttpRequest （或其他）显然只是返回内容并且不执行任何 JavaScript，因此您可以过滤掉这些请求，因为它们没有脚本设置的 cookie 值。 在 JavaScript 上运行一些混淆会更好。
You can perform a few sneaky things, but unfortunately it won't deter everyone. For example, you could place some JavaScript on a start/login page that is run when the page is loaded. This JavaScript causes a redirect and potentially writes an encrypted cookie value that is sent back to the server. Using XMLHttpRequest (or others) obviously just returns the content and doesn't execute any JavaScript, so you can can filter these requests out because they don't have the cookie value set by the script. Running some obfuscation on the JavaScript would be even better.
无法确定请求是否是伪造的。 使用 .NET HttpWebRequest 类，您可以完美模仿来自浏览器的任何有效 HTTP 请求。 但根据您的应用程序，您可以考虑以下操作之一：
您必须找出人们为什么会尝试这样做，然后找到一种方法让他们感到非常不方便。 可能以这样的方式，您可以轻松地修改验证程序，以便它们必须始终跟上。
There's no way to find out if a request is forged or not. With the .NET HttpWebRequest class you can perfectly mimic any valid HTTP request from a browser. But depending on your application, you can consider one of the following:
You have to find out why people would try to do this, and then find a way to make it very inconvenient for them. Possibly in such a way that you can easily modify the validation procedure, so that they have to keep up all the time.
您可以使用请求质询令牌来实施策略，与可能使用的策略不同用于 CSRF/XSRF 保护。 另一种可能的选择可能是使用身份验证，尽管如果您有公共网站，这可能不是很友好。
You could implement a strategy using request challenge tokens, not unlike what might be used for CSRF/XSRF protection. Another possible alternative might be using authentication, although if you have a public website this might not be very friendly.
据我所知，XMLHttpRequest 的所有实现都会向请求添加标头。
编辑：
抱歉，标头（至少在 PHP 下）是“HTTP_X_REQUESTED_WITH”
As far as I know, all implementations of XMLHttpRequest add a header to the request.
Edit:
Sorry, the header (at least under PHP) is 'HTTP_X_REQUESTED_WITH'