Google Analytics 如何防止流量欺骗
我们希望将 ajax 风格的服务嵌入到我们的许多网站中，每个网站都有一个唯一的 api 密钥。我看到的问题是，由于 api 密钥存储在 javascript 文件中，因此用户可能会获取密钥、欺骗 http 引荐来源网址，并在该 api 密钥下向 api 发出数百万个请求。
所以我想知道谷歌如何防止分析欺骗？因为这使用了几乎相同的想法。
我也对其他想法持开放态度，基本上这就是过程。
站点A->用户<->阿贾克斯<-> SiteB
编辑 - 有什么方法可以保护 API 在通过 ajax 调用时不被滥用？
We want to embed an ajax style service into a number of our websites each with a unique api key. The problem that I can see is that because the api key is stored in the javascript file the user could potentially take the key, spoof the http referrer, and make millions of requests to the api under that api key.
So I am wondering how Google prevents Analytics spoofing? As this uses almost the same idea.
I'm also open to other ideas, essentially here is the process.
SiteA -> User <-> Ajax <-> SiteB
EDIT - is there any way to protect the API from being abused while having it called via ajax?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我不认为有任何这样的保护措施。对于 Adwords 等其他 Google 服务来说，流量欺骗是一个严重的问题。例如，恶意竞价 AdWords 的人可能会为其竞争对手的广告产生许多虚假点击，从而推高其广告成本，从而推高 Google 的股价。反之亦然，人们会在其网站上产生虚假点击，以从其网站上的按点击付费广告中获取额外收入。
最终，黑客可以轻松收集 10,000 多个匿名代理服务器的列表，而您对此无能为力。黑客还可以使用僵尸网络，其中一些规模达数百万。从僵尸网络生成的流量可能看起来是具有合法 Google Cookie 的合法机器，因为它们被劫持了。
许多代理和被绑定的机器都被实时黑名单 (RBL) 枚举，例如 http://www.spamhaus 运行的黑名单.org ，许多合法的 IP 地址也在该列表中。还有一些代理不能用于垃圾邮件，但可以用于点击欺诈，因此它们不会出现在该列表中。
I don't believe there are any such protection measures in place. Spoofing of traffic is a serious problem for other Google services, such as Adwords. For instance a malicious individual who is bidding on adwords can generate many fake clicks for their competitor's ads to drive up their advertising costs and thus Google's stock price. The inverse is also true, people will generate fake clicks on their site to get extra money from a PayPer Click ad on their site.
At the end of the day a hacker can amass a list of 10,000+ anonymous proxy servers without too much difficulty and there isn't much you can do about it. A hacker could also use a botnet, some of which are millions in size. Traffic generated from a botnet can appear to be legitimate machines with a legit Google Cookie, because they where hijacked.
Many proxies and bonet'ed machines are enumerated by Realtime Black Lists (RBL) such as the one run by http://www.spamhaus.org , and many legitimate ip addresses are also on that list. There are also proxies that can't be used for spam but could be used for click fraud and thus they won't be on that list.
据猜测，我认为该密钥是公私密钥对的一半，该密钥（以某种方式）包含 URL 作为哈希值。这样，只有当请求针对生成密钥的 URL 时，密钥才会起作用，并且只会注册命中。您无法欺骗该请求，因为如果您这样做，它会转到错误的 URL 并且不会发生任何事情。
At a guess, I'd say the key is one half of a public-private key pair that (somehow) includes the URL as a hash. This way, the key will only work, and the hits only registered, if the request is for the URL for which the key was generated. You can't spoof the request, because if you do it goes to the wrong URL and nothing happens.