如何检查是否使用 cURL 执行了 post
简单的问题：如何检测发布到我的网站的表单数据是否是通过 cURL 完成的，而不是通过网站的表单页面完成的。
（例如）用户运行 curl -H"Host: http://mysite" POST "post data" http://mysite 适用于网站中的任何形式。
由于可以设置引用者和用户代理，因此我认为它们不符合过滤条件。欢迎任何建议或解决方案。
谢谢&干杯！！
Simple question: How to detect if the form data posted to my site is done through cURL and not through the site's form page.
(Ex) user runs curl -H"Host: http://mysite" POST "post data" http://mysite for any form in the site.
Since it is possible to set Referer and User Agent, i believe that they don't qualify as filtering criteria. Any suggestions or solutions are welcome.
Thanks & Cheers!!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我不确定您的安全问题是什么，因为您没有告诉我们。就 Web 服务器而言，cURL 实际上只是另一个 Web 浏览器；它只是碰巧是由命令行参数而不是鼠标控制的。
也许您担心保护自己免受跨站点请求伪造并且应该看看 OWASP CSRF 预防备忘单
I'm not sure what your security concern is, as you don't tell us. As far as the web server is concerned, cURL is effectively just another web browser; it just happens to be one that is controlled by command-line arguments and not a mouse.
Maybe you are concerned about protecting yourself from Cross-Site Request Forgery and should look at the OWASP CSRF Prevention Cheat Sheet
将令牌添加到动态生成的表单并将其存储在用户会话中。当用户提交表单时，检查表单中的令牌是否与会话中的令牌匹配。每次呈现表单时，该标记都应该更改。这将允许该表格仅提交一次。
如果用户提交带有过时令牌的表单，只需让他们再次重新发布该表单，并显示一条错误消息，说明该表单已过时，他们需要再次重复该操作。
Curl 可以模拟浏览器，因此不会 100% 有效，但这涵盖了大多数情况。
您还可以使用 JavaScript 填充此标记字段，因为curl 不会执行它。
Add a token to your form that you generate dynamically and store it in the users session. When the user submits a form check that the token from the form matches the token that's in the session. This token should change every time the form is rendered. This will allow the form to be submitted only one time.
If the user submits a form with a stale token, just have them repost the form again with an error messages saying the form was stale and they need to repeat the operation again.
Curl can emulate a browser so nothing is going to be 100% effective, but this covers most of the cases.
You could also have this token field filled by JavaScript since curl doesn't execute it.
我想需要检查一下表单提交按钮是否被触发。
I guess one would need to check to see if the form submit button was triggered.