阻止用户通过网络浏览器访问网页？
我和我的朋友正在开发一个程序。该程序将向我们的网页提交 GET 数据。但是，我们不希望用户通过程序以外的任何其他方式访问网页。我们可以阻止用户使用 HWID 身份验证共享程序，但没有什么可以阻止他们使用数据包扫描器来获取网页的 URL。我们考虑了用户代理身份验证，我们将实现它，但用户代理很容易被欺骗。
那么我的问题是，怎样才能阻止用户直接访问网页，而不是通过程序呢？
即使你没有一个完全有效的答案，任何有助于阻止他们的东西都会很好。
目前我们将实施：
HWID 身份验证以使用该程序 访问网页的用户代理身份验证 无需正确用户代理即可将任何访问网页的人即时列入 IP 黑名单
My friend and I are working on a program. This program is going to submit GET data to our webpage. However, we don't want users accessing the webpage any other way than the program. We can prevent users from sharing the program using HWID authentication, but nothing prevents them from using a packet scanner to get the URL of the webpage. We thought about user-agent authentication, which we will implement, but user-agents can easily be spoofed.
So my question is, how can we prevent users from accessing the webpage directly, instead of through the program?
Even if you don't have an answer that will completely work, anything that will help deter them would be nice.
Currently we will be implementing:
HWID Authentication to use the program
User-Agent Authentication to access the web page
Instant IP Blacklisting to anyone accessing the webpage without the proper User-Agent
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
不要依赖用户代理或任何类型的浏览器指纹，HTTP 标头很容易伪造/欺骗。
您可以在请求中添加一些秘密令牌（例如密码/登录名）并通过 SSL 发送以防止窃听。
或者更好的是，使用 SSL 客户端证书。
编辑 您要分发 VB 程序吗？如果是这样，正如 bobince 提到的，您将无法阻止坚定的黑客伪造请求。您可以提高标准，但这将是通过默默无闻实现安全。即使有了客户端证书，黑客也能够从您的程序中提取证书并发送修改后的请求。
只要你接受客户端的请求，这些请求就可以被伪造。处理它。
Do not rely on user agent or any kind of browser fingerprint, HTTP headers are easily forged/spoofed.
You could add some secret token (eg. password/login) to the request and send it through SSL to prevent eavesdropping.
Or better, use an SSL client certificate.
Edit Are you going to distribute the VB program? If so, as bobince mentioned, there's no way you can prevent a determined hacker to forge requests. You can raise the bar but it will be security through obscurity. Even with client certs, the hacker will be able to extract the cert from your program and send modified requests.
As long as you accept requests from the client, these requests can be forged. Deal with it.
一种选择是您可以在请求标头中设置加密令牌。
Token只能使用一次。如果再次发送相同的令牌，服务器将拒绝它，这意味着您必须在服务器端维护已使用令牌的副本。
One option is you can set an encrypted token in the request header.
The Token can be used only for single time. If the same token is sent again the server will reject it, means u have to maintain the copy of utilized tokens on the server side.
一种选择是使用并验证网络浏览器不发送的自定义标头，我为自己的程序做了类似的事情。在您正在进行的其他验证之上执行此操作。在服务器端，让您的服务器脚本验证自定义标头，并在标头错误时简单地重定向
one option is to use and verify a custom header which a web browser does not send, i did a similar thing for a program of my own. Do that ontop of the other verifications you are doing. On serverside, have your server script verify the custom header and simply redirect if the header is wrong
尝试使用长密钥（512 位或更多）加密您的所有网页，并使用 HWID 作为盐。
这样，只有您的程序可以对其进行解码并将其呈现为网页。
<块引用>
en.wikipedia.org/wiki/Salt_%28cryptography%29
。
C# 和 C# VB.net 在这里：
<块引用>
obviex.com/samples/hash.aspx
Try encrypting all ur webpages using the a long key(512bits or more) use the HWID as a salt.
This way only ur program can decode it and render it as a webpage.
C# & VB.net here: