Re: Preventing Request.Form abuse

"John Timney (MVP)" <x_john@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:9cCdnSxkqMv0H6PYnZ2dnUVZ8qudnZ2d@xxxxxxxxxxxxxxxxx

John,

A list of forms that are only subject to postback on submission is easy to
create and could reside in web.config (or anywhere cachable) - crude, but
we can think of another way later. A begin request intercepted in an
ihttpmodule could verify the ispostback property of any request. If its
not a postback form, and is in the list of forms that require postback
then dump the request and return a redirect to some random fictitious URL.
It wont even touch the actual form being requested.

I like it!

If we were to use a real rather than a fictitious URL for the redirect, do
you think that would be a good thing or a bad thing? I guess it would be a
bad thing because (I suppose) it would look to the target URL that the
posting was coming from our IP address rather than the spammer's IP
address...

Being based in the UK, I think I would find it rather satisfying if the
spammers suddenly found themselves trying to post here:
http://www.met.police.uk/computercrime/

:-)


.

Relevant Pages

  • Re: Preventing Request.Form abuse
    ... I think I would redirect them to a large video file on one of the online ... also block their IP real time in the filter, so any future request from them ... If we were to use a real rather than a fictitious URL for the redirect, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Preventing Request.Form abuse
    ... I was thinking more along the lines of extending the Page class. ... Remember that the legal use of the form also involves a postback (does ... so you can't block on the basis of the request being a postback. ... hence the suggestion of the fictitious URL. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Preventing Request.Form abuse
    ... Remember that the legal use of the form also involves a postback (does it, ... so you can't block on the basis of the request being a postback. ... someone else server and use their bandwidth, hence the suggestion of the fictitious URL. ... suggestion though - Juans a likely candidate for sinking my idea......lol ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: HELP! - I need to setup a temporary IIS redirect while I fix SQL Injection vulnerabilities o
    ... Can I go a global redirect like this in IIS to prevent the request ... but it will NOT scan the Querystring. ... All it takes is a few encodings/permutations and ...
    (microsoft.public.inetserver.iis.security)
  • Re: NetApp filers 3rd party API
    ... then I'd trigger operations based on this request ... and finally redirect the request back to the NetApp. ...
    (comp.arch.storage)
Loading