通过在 Web 应用程序中使用哈希用户 ID 来防止垃圾邮件发送者
我正在构建一个 Web 应用程序，允许用户向其他用户发送消息。在发送消息页面上，我当前在 URL 中包含接收者的用户 ID，以便应用程序知道将消息发送到哪里，即 example.com/send-message/user-id/1。用户 ID 是用于识别数据库中接收者的主键，
我担心垃圾邮件发送者可能会访问此页面并不断更改 URL 中的用户 ID，并很快在网站上向用户发送垃圾邮件。
我想出的解决方案是制作一个长的唯一ID（123154123412）。该号码将存储在用户数据库行中，并用于代替发送消息页面上的主键，以便垃圾邮件发送者无法通过更改 ID 轻松向大量用户发送垃圾邮件。
这种方法是否存在我可能忽略的潜在问题？
如果我在整个网站中使用唯一的 ID，它会显着降低网站速度。换句话说，使用主键搜索数据库比生成的唯一 ID 更快。
谢谢
I am building a web application that allows users to send messages to other users. On the send message page I currently have the user id of the receiver in the URL so the application knows where to send the message i.e. example.com/send-message/user-id/1. The user id is the primary key used to identify the receiver in the database
I am concerned that spammers could go to this page and just keep changing the user id in the URL and spam people on the site very quickly.
The solution I have come up with is to make a long unique id (123154123412). This number will be stored in the user database row and would be used instead of the primary key on the send message page so that a spammer could not easily spam lots of people by changing the id.
Are there any potential problems with this approach that I may have over looked?
If I was to use the unique id throughout the site would it slow the site down significantly. In other words is it quicker to search the database using a primary key than a generated unique id.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以做的另一件事是，当会话或 IP 地址在短时间内发送过多消息时（例如，消息之间间隔 1 分钟，每 15 分钟最多 5 条消息），暂时阻止会话或 IP 地址。
Another thing you can do is to block sessions or ip addresses temporarily when they send too many messages in short time ( eg. 1 min between messages and max 5 messages per 15 min ).
这种做法是绝对没有用的。
只要您网站的用户允许向其他用户发送消息，垃圾邮件发送者就会使用您发明的任何 ID。
唯一的方法是限制每小时的收件人和/或消息数量。
This approach is absolutely useless.
As long as users of your site allowed to send messages to other users, the spammers will use whatever id you invent.
The only way is to limit the number of recipients and/or messages per hour.
我想说，允许人们在网站上任意向其他成员发送消息通常是一个坏主意（除非这是我认为网站的重点）。您可能会阻止自动垃圾邮件机器人，但有很多人愿意花钱请真人来手动发送消息。首先也是最重要的，您可能应该只允许登录的成员向以某种方式“接受”该成员的其他人发送消息——朋友，允许来自等的消息。
就使用长 UID 而言，只要您正确设置数据库，唯一的性能“打击”可能是在生成数据库时，但如果您使用它代替主键 ID，则不会减慢您的站点速度。
I would say it's generally a Bad Idea to allow people to arbitrarily message other members on a website (unless that's the point of the site I suppose). You might prevent automated spam bots, but there are plenty of people willing to pay an actual human to go around and send messages manually. First and foremost, you should probably only allow a logged in member to send a message to someone else who has "accepted" that member in some manner -- a friend, allow messages from, etc.
As far as using a long UID, as long as you have your database set up properly the only performance "hit" might be when you generate it, but it's not going to slow your site down if you use it in place of the primary key ID.