保护我的网站内容不被通过 cURL 下载
我听说通过以下代码使用curl 进行网站的外部访问：
$curl_handle=curl_init();
curl_setopt($curl_handle,CURLOPT_URL,'http://example.com');
$buffer=curl_exec($curl_handle);
curl_close($curl_handle);
我想保护我的网站免受此外部访问。我正在使用 PHP。我如何保护我的网站？
I heard about external access of a website using curl by the following code:
$curl_handle=curl_init();
curl_setopt($curl_handle,CURLOPT_URL,'http://example.com');
$buffer=curl_exec($curl_handle);
curl_close($curl_handle);
I want to protect my website from this external access. I am using PHP. How can I protect my web site?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
这并不比任何人使用浏览器访问您的网站更危险；事实上，就您的问题而言，这就是
curl的含义：一个网络浏览器，仅此而已。如果你有安全漏洞，它们就会被破坏。如果没有，他们就不会。然而，
curl不会放大或减少任何漏洞；它只是 PHP 脚本访问另一个网站的一种方式（通常通过 HTTP）。如果您想阻止内容被下载，您可以阻止传入的 HTTP 请求，但这违背了网站的目的，因为 Web 浏览器会发出相同的请求（并且也可以下载内容）。
This is no more dangerous than anyone accessing through your website with a browser; in fact, this is what
curlis as far as your question is concerned: a web browser and nothing more.If you have security vulnerabilities, they will be broken. If not, they won't.
curl, however, does not amplify or diminish any vulnerabilities whatsoever; it is merely a way for a PHP script to access another website (typically through HTTP).If you want to prevent content from being downloaded, you can block incoming HTTP requests, but this defeats the purpose of a web site, since web browsers make identical requests (and can also download content).
如果您的意思是“如何保护我的网站不被浏览器以外的程序访问”，那么答案几乎是“您不能”。浏览器只是一个发送 HTTP 请求的程序。您可以尝试拒绝看似不是来自浏览器的 HTTP 请求，但对于任意程序（使用curl 或 Perl/Python/Ruby 库的程序）来说，模仿 HTTP 请求的标头是非常容易的。 “真实”浏览器发送。
If you mean "how do I protect my website against being accessed by a program other than a browser", the answer is pretty much "you can't." A browser is just a program that sends HTTP requests. You can play the game of trying to reject HTTP requests that look like they don't come from a browser, but it's trivially easy for an arbitrary program (one using curl, or Perl/Python/Ruby libraries) to mimic the headers that a "real" browser sends.
我同意 waiwai 的观点，但是，如果您确实想“保护”自己免受基本的非浏览器访问，请考虑加密您的内容并在访问网站时使用 JavaScript 等进行解密。任何理解 JavaScript（并启用它）的浏览器都能够正确显示内容。但即使是对内容进行加密也可以轻松解决。
挫折是 1) 它不“安全”，2) 搜索引擎可能会错误地索引您的网站（毕竟，它们使用类似 cURL 的调用），3) 禁用 JavaScript 的用户无法访问您的内容。
总的来说，我会说这是不值得的。
I agree with waiwai, however, if you really want to 'protect' yourself against basic non-browser access, consider encrypting your content and decrypting it using, say, JavaScript when the site is accessed. Any browser that understands JavaScript (and has it enabled) will be able to display the content properly. But even encrypting the content can be worked around easily.
The setbacks are 1) it's not 'secure', 2) search engines may index your website incorrectly (afterall, they use cURL-like calls), 3) users who have JavaScript disabled are unable to access your content.
Overall, I'd say it's not worth it.
如果您希望用户能够看到它，则不能这样做。
您可以设置一些系统，以便它不会提供某些内容，除非同一用户最近请求了另一个相关的内容，但即使这样也不会阻止真正想要获取它的人......
You can't, if you want your users to be able to see it.
You could set up some system so that it won't serve up some content unless another related piece of content was very recently requested by the same user, but even that will not stop someone who really wants to get it...
您可以做的另一件事是使用 保护您的网站验证码。这将阻止通过curl 进行访问，但将允许您的用户访问。
请注意，这样做会阻止搜索引擎访问您的网站。
Another thing you can do is protect your site with a Captcha. This will prevent access via curl but will allow your users access.
Be aware that doing this will stop search engines from visiting your site.