防止 HTTP 暴力攻击
因此，我有一个 PHP 脚本，它接受用户“密钥”并检查它是否有效。我不希望他们在 3 次尝试失败后仍能提交表单。
我有使用cookie的想法，但由于它们是客户端，所以它们可以被刷新，所以它看起来是我的脚本的第一次尝试。也使用会话，但因为它们在会话后过期。就很容易绕过了。该程序不需要数据库，如果可能的话我想避免它。
我还考虑需要验证码才能提交表单。这是最好的选择吗？ 我期待听到您的建议。
So, I have a PHP script that takes a users 'key' and checks if it is valid. I don't want them to be able to submit the form after 3 failed attempts.
I had the idea of using cookies, but since they are client side they can be flushed so it appears as the first attempt to my script. Also using sessions but since they expire after a session. It would be easy to bypass. The program doesn't require a DB and I would like to avoid it if possible.
I also thought of requiring a captcha in order to submit the form. Is that the best option?
I look forward to hearing your suggestions.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
由于您显然已经存储了用户和密钥，因此也要跟踪失败的尝试。针对每个用户而不是每个会话进行此操作，因为攻击者每次都可以很容易地假装是新连接。有了这些信息，您的登录尝试时间就会呈指数增长。
如果您还跟踪上次失败尝试的时间，则可以使用它来减少随着时间的推移失败的尝试。
如果您不确定是否要使用验证码，也许在第一次尝试失败后使用它是一个好主意。
Since you obviously already store user and key, keep track on failed attempts, too. Make this per user, not per session, since it's easy enough for the attacker to pretend being a new connection every time. With this information you can have the login attempt take exponential longer.
If you also keep track of when the last failed attempt was, you can use it to decrease failed attempts over time.
If you aren't sure you want to use a captcha, perhaps it's an idea to use it after the first failed attempt.
使用
$_SERVER或验证码检查 IP 地址REMOTE_ADDR和引荐来源网址HTTP_REFERER听起来不错。所有这些的混合是最有效的。IP address
REMOTE_ADDRand referrerHTTP_REFERERcheck using$_SERVERor Captcha sound good. A mix of all is most effective.我建议使用外部验证码服务，例如 recaptcha：http://www.google.com/recaptcha/learnmore
强调外部
I would suggest an external captcha service like recaptcha: http://www.google.com/recaptcha/learnmore
emphasis on external
如何向 url/cookie 添加一个字符串，其中包含当前时间、尝试次数以及其中的一些哈希值。这样，由于时间检查，重复使用以前的此类字符串将不起作用，并且生成此类字符串需要通过样本对哈希函数进行逆向工程，这是非常困难的。
How about adding a string to url/cookie, with current time, attempt number, and some hash of these. Like that, reusing the previous such string won't work because of time check, and generation of such string would require reverse-engineering of hash function by samples, which is very hard.