Heroku 上的 Rails 应用程序 - 请推荐防御性编程技术
我刚刚在 heroku.com 上上线了一个 Rails 应用程序，该应用程序为一些触摸屏信息亭提供服务，并且我第一次遇到了恶意用户进行一些虚假服务预订的情况。我想要一些有关审计数据的建议，我可以记录这些数据，以帮助我追踪或以其他方式阻止或防止此类恶意活动。
一些简短的背景 - 我设计了一个基于 Rails 的网站，该网站针对旅游业，允许客户预订住宿和其他旅游相关服务，例如乘船游览。我们在触摸屏信息亭（想想带有 40 英寸触摸屏的 6.5 英尺高的设备）上运行此应用程序，并向服务提供商发送预订电子邮件通知。
我正在寻找的是关于我可以在预订时记录的内容的建议（以及其他信息）。交易）的发生，以便我可以帮助验证有效的预订并记录详细信息，以便以后追踪这些虚假预订，然后我可以将此信息添加到黑名单中，以阻止这些机器造成进一步的问题
。已经记录了request.remote_ip 地址，但理想情况下也希望能够记录 remote_ip 的主机名，因为 IP 地址可能会动态更改，这可能吗？我应该创建一个随机密钥并将其存储为 cookie 以唯一标识每个客户端计算机。 ？
我并不打算起诉每一个进行虚假预订的人，我只是希望能够阻止、防止或跟踪此类恶意活动，并且希望您能提供有关如何做到这一点的建议。
非常感谢， 克雷格.
I've just put a Rails app live on heroku.com which services some touchscreen kiosks and have had my first taste of malicious users with some bogus service bookings. I would like some suggestions on audit data which I can log to help me to track down or otherwise discourage or prevent such malicious activities.
Some brief background - I have designed a Rails based website which is targeted towards the Tourist industry and allows customers to book accommodation and other tourist related services such as boat trips. We run this application on touchscreen kiosks (think 6.5 foot tall units with 40" touch screens) and email notifications of bookings to service providers.
What I'm looking for is suggestions on things that I can record at the point of bookings (and other transactions) taking place so that I can help to authenticate valid bookings and record details which can be used later to trace these bogus bookings. I might then add this information to a black-list to block these machines from creating further problems.
I'm already recording the request.remote_ip address but would ideally like to be able to record the hostname of the remote_ip as well since the IP address might change dynamically. Is this possible? Should I create a random key and store it as a cookie to identify each client machine uniquely?
I'm not looking to prosecute every person who makes a bogus booking, I just want to be able to discourage, prevent or track such malicious activity and would appreciate any suggestions on how best I can do this.
Many thanks,
Craig.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为这个问题有点模糊。您需要看看您所知道的：什么是无效的虚假预订？您个人是如何发现某些特定预订是伪造的？有人告诉过你吗，你自己根据数据算出来的吗？
您首先需要收集虚假预订的所有细节，如果存在某种模式，那么您就可以将其作为过滤器实施。我的意思是，如果有人知道预订是假的，为什么你的系统不知道呢？
记录 IP 地址和主机名是徒劳的......你永远不会抓到谁这样做了。为什么不预先使用信用卡号码或至少确认的电子邮件地址进行验证？如果您有预先的信用卡号，那么您可以直接链接到该人以解决争议和/或阻止通过卡号进行进一步的尝试。 IP 地址太难追踪。
IP 地址可以通过反向查找转换为主机名，但如果 IP 更改，主机名也会更改。如果您已经记录了 IP，则稍后可以随时进行反向查找，但我并没有真正看到了解主机名的价值（？）。
The question is a bit vague I think. You need to look at what you know: what actually IS a non-valid bogus booking? How did you personally figure out that some particular booking was bogus? Did someone tell you, did you figure it out from the data yourself?
You first need to gather all the bits and pieces you have of bogus bookings, and if there is a pattern then that is what you implement as a filter. I mean if someone knew a booking was bogus, why did your system not know it?
Logging IP addresses and hostnames is kind of futile..you'll never catch whoever did it this way. Why not validate up-front with credit card numbers or minimum a confirmed e-mail address? If you have an up-front credit card number then you have a direct link to the person for disputes and/or blocking further attempts by card number. IP addresses are too hard to track.
An IP address can be converted to a hostname by a reverse lookup, but if the IP changes the hostname changes too. If you alreay log an IP, you can always do a reverse lookup later, but I don't really see the value of knowing the host name(?).