如何保护 OpenID 消费者免遭滥用？
我正在考虑将 OpenID 作为我的 PHP 应用程序的登录方法，但有一件事阻止我继续：如何保护 OpenID 使用者免受滥用？
滥用包括向其他服务器发送大量请求、使用我的应用程序作为代理、将大量下载作为 URL 传递或通过执行大量请求来不必要地减慢服务器速度。
我想我应该对执行请求实施速率限制，但我该怎么做呢？可能的攻击者可以使用其他代理或 TOR 来绕过 IP 检查。限制允许的提供商违反了 OpenID 的原则，对吗？
我不希望我的用户是邪恶的，但我想知道在添加另一个可能的攻击向量之前需要考虑哪些事情。
如果重要的话，我将使用 lightopenid 作为 PHP 应用程序的后端。
I am considering OpenID as a login method for my PHP application, but there is one thing that prevents me from continuing: how can I protect an OpenID consumer against abuse?
An example of abusing OpenID by using a consumer as proxy
Abuse includes flooding other servers with requests, using my application as a proxy, passing a large download as URL or unnecessarily slowing down the server by doing a lot requests.
I guess I should implement rate-limiting on doing requests, but how am I supposed to do that? Possible attackers could use other proxies or TOR for bypassing IP checks. Limiting the providers which are allowed would be against the principles of OpenID right?
I do not expect my users to be evil, but I'd like to know which things I need to take into account before adding another possible attack vector.
Should it matter, I'm about to use lightopenid as back-end for the PHP application.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您需要将攻击分为两个池。 1) 针对您自己的网站的攻击，以及 2) 针对使用您作为代理的其他人的攻击。这些问题都不是新问题，也不是 OpenID 独有的。例如，经典的“告诉朋友”电子邮件表单可以自动从代理方的 IP 地址和电子邮件发送垃圾邮件，保护垃圾邮件发送方免受后果，并为他们提供（可能）干净的 IP/电子邮件已被垃圾邮件防护标记。这主要是通过“CAPTCHA”解决的，以防止表单的自动使用。
对于针对您自己网站的攻击，这方面的内容之前已经被介绍过无数次了。请尝试此处：保护自己免受 DOS 攻击
对于针对他人网站的攻击，许多与其他问题中提到的原则相同。限制身份验证请求，拒绝不合理或格式错误的请求，根据 POST 返回的实际内容验证 Content-Length 标头，当然，您始终可以添加经典的“CAPTCHA”以帮助防止使用 OpenID 消费者的自动攻击。
与此处的其他建议相反，我不会根据 OpenID TLD 进行限制，而是根据请求方的 IP 地址进行限制。是的，人们可以租用代理 IP，但您无法根据 TLD 进行公平限制，因为每个 OpenID 提供商的用户群差异很大。您还可以从 MaxMind 等公司购买已知代理 IP 的数据库。如果用户来自代理 IP，请增加限制的强度。
You need to separate the attacks into two pools. 1) Attacks against your own site, and 2) Attacks against someone else using you as a proxy. Neither of these issues are new or unique to OpenID. For example the classic "tell a friend" email forms could be automated to send out email spam from the proxy party's IP address and email, shielding the spamming party from consequences and providing them with a (potentially) clean IP/email that isn't already flagged by spam protection. This was primarily addressed with the "CAPTCHA" to prevent automated use of the form.
For attacks against your own site, this has all been covered countless times before. Try here: protect your self against DOS attacks
For attacks against someone else's site, many of the same principals apply as mentioned in that other question. Throttle authentication requests, reject unreasonable or malformed requests, verify the Content-Length header against actually content on POST back and of course you can always add the classic "CAPTCHA" to help prevent automated attacks using your OpenID consumer.
Also contrary other suggestions here, I wouldn't throttle based on the OpenID TLD, but rather the requesting party's IP address. Yes people can rent proxy IPs, but you can't fairly throttle based on the TLD as the userbase for each OpenID provider will vary widely. You can also purchase a database of known proxy IPs from a company like MaxMind. If the user is coming from a proxy IP, increase the aggressiveness of your throttling.
根据请求某个域的次数按比例减慢请求。
例如，假设有人试图通过请求许多 URL（例如
http://example.com/foo、http）来使用您对服务器、example.com进行 DOS 操作://example.com/barhttp://example.com/foobar120382。将所有这些请求视为对example.com的请求，并立即执行第一个请求。在发出下一个请求之前延迟 2 秒，在发出第三个请求之前延迟 4 秒，在发出第四个请求之前延迟 8 秒，在第五个请求之前延迟 16 秒，依此类推。人类用户几乎不会注意到如此小的延迟，但会大大降低服务器充当 DOSsing 代理的能力。试想一下，第 12 个请求将被阻止超过 1 小时（如果使用 2 的幂）。
显然，您还应该为常见的大型 OpenID 提供商（例如 Google 或 myOpenID）创建某种白名单或灰名单。这些域名可能会被频繁请求。
Slow down requests proportionally to the number of times a certain domain has been requested.
For example, suppose that somebody tries to use you to DOS the server
example.comby requesting many URLs likehttp://example.com/foo,http://example.com/bar,http://example.com/foobar120382. Consider all this requests as requests forexample.comand execute the first request without any delay. Delay 2 seconds before making the next request, delay 4 seconds before making the third request, delay 8 seconds before making the forth request, 16 before the fifth and so on.Such little delays are pretty much unnoticed by human users but will highly reduce the ability of your server to act as a DOSsing proxy. Just think that the 12th request will be blocked for more than one hour (if you use powers of two).
Obviously you should also create some kind of white- or gray-list for common large OpenID providers like Google or myOpenID. Those domains are likely to be requested very often.
我会做一些更简单的事情。将 OpenID 端点限制为一组有限的可信端点：Google、wordpress、myopenid、yahoo。它可能会覆盖大多数用户，并且不会让机器人让您的网站产生随机网站的流量。
I would do something simpler. Limit the OpenID endpoints to a limited set of trusted ones: Google, wordpress, myopenid, yahoo. It will probably cover most of the users, and will not make it possible for bots to make your site generate traffic to random sites.