rv20 Posted June 2, 2009 Share Posted June 2, 2009 If you have say a login.php script, or any script, and want to stop it being run directly, or at least check that the referer is coming from your own site then all i can see to secure it are these, depending if it is a GET ot POST method, $http_referer = parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST); if ( ($http_referer == "domain.com") || ($http_referer = "80.80.80.80.80") ){} //POST or GET for example if ($_SERVER['REQUEST_METHOD'] == "POST") {} Also how about having a max number of times you an access the page before a lockout, i suppose this would technically be a DOS attack which you would really have to fix at the router?? Basically i am being paranoid thinking that someone could try and break into your site by using a whole variety of tricks and techniques which i don't really know what tricks are out there so don't know what i am trying to secure against. I suppose there is, xss, css explots, sql injection, query string manipulation??, hacking the db directly, other browser exploits......hmmmm Quote Link to comment Share on other sites More sharing options...
Garethp Posted June 2, 2009 Share Posted June 2, 2009 Well, it's best if you do SESSIONS. You can track where people go on your site using SESSIONS and they won't realize it. Their browser can't fake it like they can with POSTS and GETS, and you can use SESSIONS to store how many times people try to log in, how many times people access your page in how many seconds. Anything Quote Link to comment Share on other sites More sharing options...
KevinM1 Posted June 2, 2009 Share Posted June 2, 2009 Well, it's best if you do SESSIONS. You can track where people go on your site using SESSIONS and they won't realize it. Their browser can't fake it like they can with POSTS and GETS, and you can use SESSIONS to store how many times people try to log in, how many times people access your page in how many seconds. Anything You can also reset a user's session id, which is a smart move when they navigate to and from vital areas of a site. See: http://www.php.net/manual/en/function.session-regenerate-id.php Quote Link to comment Share on other sites More sharing options...
Garethp Posted June 2, 2009 Share Posted June 2, 2009 Can you explain how it would be a smart move? I've never heard of it before, and I'm just checking out the link you gave me Quote Link to comment Share on other sites More sharing options...
PFMaBiSmAd Posted June 2, 2009 Share Posted June 2, 2009 HTTP_REFERER can be easily faked (it is just a header that is sent with the http request) so it cannot be relied on for any security purposes. Using session variables to detect failed log in attempts or to count page accesses for any security checking also cannot be relied on because the visitor (or bot script) can simply drop the current session id and establish a new session to reset all the counts. Quote Link to comment Share on other sites More sharing options...
rv20 Posted June 2, 2009 Author Share Posted June 2, 2009 The session_regenerate_id(); look like good advice that is the kind of thing i am looking for, anything else? Quote Link to comment Share on other sites More sharing options...
rv20 Posted June 2, 2009 Author Share Posted June 2, 2009 HTTP_REFERER can be easily faked (it is just a header that is sent with the http request) so it cannot be relied on for any security purposes. Using session variables to detect failed log in attempts or to count page accesses for any security checking also cannot be relied on because the visitor (or bot script) can simply drop the current session id and establish a new session to reset all the counts. This is exactly what i thought and hence what i am asking, so you are saying that session_regenerate_id(); will solve this? If it was a form POST i think you can send a hash in a hidden field i haven't looked into how this works but i assume this method is secure, that leaves a GET request basically.... Quote Link to comment Share on other sites More sharing options...
Garethp Posted June 2, 2009 Share Posted June 2, 2009 No, POSTS can be faked too easily. Hidden fields are still shown in the HTML. You can fake a hidden field. GETs are the least secure Quote Link to comment Share on other sites More sharing options...
rv20 Posted June 2, 2009 Author Share Posted June 2, 2009 No, POSTS can be faked too easily. Hidden fields are still shown in the HTML. You can fake a hidden field. GETs are the least secure So what is the point of all these massive hash values you see in sites like youtube, facebook, paypal etc, i am talking about 100's of character long hashes, i think the hash are sent in hidden fields, maybe not though, i just remember looking at source in the past and seeing these huge what, i assume now, were hashes. Quote Link to comment Share on other sites More sharing options...
gevans Posted June 2, 2009 Share Posted June 2, 2009 A lot of the time hashes are used for renaming files. Or a random string that may appear like a hash. The number of file uploads youtube handles, it needs a way of building its own filenames that will not be the same as another. On a small scale I use a random 6 digit integer attached with a timestamp. My max uploads is 9, so the chances of generating 9 random 6 int numbers and two of them matching is so tiny I don't care about it. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.