Check where the POST came from

Question

Is there any way to limit the sending of POST forms by third parties to my website? Deny everyone, like there’s the URL that does it like a robot, but I wanted to inhibit, it’s like?

When I say third party I say from another site not being my own.

Answer 1

For any measure of yours, think of two savings: First, cost of doing nothing (high for a bank, low for a blog) vs. cost of measurement (development, maintenance, friction for legitimate users). Second, measures increase the cost of the attacker more than the cost to you and your users. Security is never absolute and always a compromise.

Limit automated/repeat access (bots/spam)

Forms are abused by flooding manually or automated. Any attack will be as close as possible to a legitimate request - the attacker’s effort will depend on the reward.

• Use recaptcha etc.
• Block session or IP after x attempts¹
• Limit sending to x attempts/minute per IP¹ or to the entire website (which may harm legitimate users)
• Return a unique ID that was generated when displaying the form, valid for a single submission and for a limited time (Wikipedia does something similar. The attacker would have to reload the form, increasing the server load)
• Create a pause interval. If your form responds in 0.5s, a 5s interval is tolerable for users and reduces the number of submissions from 120/s to 12/s
• Need an e-mail reply
• Create manual authentication ("your registration needs to be authorized by the administrator").

Limit access of persons not previously authenticated

Remember that HTTP is stateless, no status. In principle, each call you receive without prior history and need to prove that you have approved the issuer before:

• Prove that the user has been previously authenticated (it provides a cookie or an attribute POST of a session that exists on the server - third parties have to guess or steal the ID of an active session on the server)
• Prove that he visited another address before (HTTP_REFERER - easily forged)
• Prove that they know a certain secret (special POST address/password/attribute - can leak or be detected easily).

Limit access to all requests

• Ban IP sequences (from known offenders, from outside the company/client network, from a certain country - can be forged and disrupt legitimate users by accessing from an unusual place, such as travellers)
• Ban certain requests (e.g. never receive POST).

¹Everything related to IP can be tricked by using multiple Ips, Vpns or acquiring a new IP.

Answer 2

Something effective is to check the "dns Reverse lookup". On your hosting provider, set up or ask to set up "dns Reverse lookup" or "reverse dns" in English.

So whenever you receive a request (POST, GET), check the "dns Reverse lookup" by IP.

In PHP there are network functions like gethostbyname, gethostbyaddr and dns_get_record with which you can extract the data to assist in "authentication".

Note that the "dns Reverse lookup" can also be circumvented, so do not trust 100% as if it were an absolute solution. However, it is much safer than checking only HTTP_REFERER. HTTP_REFERER is easily manipulated, including by CURL has an option to do so. But reverse dns requires change in the server configuration that submits the data.

We can say that 99.999% of bots are unable to change the reverse dns of the servers they use because, logistically, bots target millions of servers and would need to modify millions of times the reverse dns of the servers they run their scripts for. It is something unfeasible due to the high cost.

For example, if your site has the www.seu.site address, set the reverse dns to "www.seu.site". In shared hosting server it is not normally allowed to customize, but you can ask the company that manages the server, that at least configure the reverse dns to return a valid name. It usually looks something like "address.provedor.hopedagem".