|
Posted by Ben Bacarisse on May 9, 2008, 1:18 pm
Please log in for more thread options
> Gazing into my crystal ball I observed Ben Bacarisse
>
>> A while back I suggested a method of using timestamps to filter out at
>> least some automatic form postings.
<snip>
>> Briefly, the current time is encoded in a hidden form field when the
>> page containing it is served. The script that processes the form
>> checks the (new) current time against that in the form and rejects the
>> submission if it is either too fast or too slow.
<snip>
>> Of course, the time stamp must be protected so that tampering could be
>> detected, although no examples of altered or missing timestamps showed
>> up in this test (which it hardly surprising, why would a bot alter
>> some mysterious hidden field?).
<snip>
> You could enhance it by placing the time into a db, and upon submission,
> compare the value in the db. Generate a unique identifier as a hidden
> field, and compare that to the one in the db with the time
> submitted.
I am not sure that would add anything. Currently, the server sets the
hidden field to:
time + ":" + md5(time + "some secret string")
When the form comes back, the server splits the string at the ":" and
it computes md5(part-before-the-colon + "some secret string").
Checking that this md5 hash matches the part after the colon is
equivalent, I think, to looking up a unique ID in a server-side DB
(but simpler to do).
--
Ben.
| 
XML Sitemap