2

I am using a simple PHP API that takes requests and connects to a MySQL DB to store/retrieve user information. Example: Login is done using a HTTP POST to the API with username and password.

How do I prevent people from flooding my API with requests, potentially making thousands of accounts in a few seconds.

Thanks

Josh
  • 197
  • 1
  • 4
  • 15
  • Register their IP in a table and count the number of requests made. Define a limit (e.g. Requests per 12 hours), check number of requests made when a new one comes in and reject if they exceed the limit. **Edit** consider using a CAPTCHA mechanism in addition to make sure humans are entering the data. – nicolaus-hee May 09 '15 at 04:15
  • use captcha in form and in api check if form submitted or not? such as if($_SERVER['REQUEST_METHOD'] == 'POST') – user1844933 May 09 '15 at 04:24
  • where are we on this question ? If you received an answer please mark it – Uri Goren May 24 '15 at 09:30

2 Answers2

3

You could serve a token generated and remembered on the server side which is rendered with your forms and validated when the form is sent back to your server. That prevents the user from just generating new post requests without actually requesting the according form from your server since they need the according token generated on your server to get it through.

Then there is the mentioned captcha which would be way too much for a login form from my point but when it comes to things like registering a new user the captcha in combination with the token sounds very good to me.

UPDATE I Just found this article which is about floot protection of script execution in general. I think their approach is good as is the ip tracking provided you have the ability to use memcache or something similar to speed the checks up.

Community
  • 1
  • 1
tworabbits
  • 1,203
  • 12
  • 17
2

First, when registering a user, also save her IP address at the time of registration in the DB.

If the IP already exists within 45 minutes of previous registration, reject the request.

Another method is the Captcha, I personally prefer a different method that I found to be even more effective against robots.

Instead of asking the user to "type what they see in an image", and verify they are humans (or robots with sophisticated image processing),

Add another field (for example city), and make it hidden with javascript.

The robots would submit that field to the server, and humans would not.

Note that the robots must run the javascript in order to know what fields are hidden, and this is a time consuming process that they usually don't do.

(see turing halting problem)

Uri Goren
  • 13,386
  • 6
  • 58
  • 110