Re: Email spam - possible problem.

On Nov 24, 2006, at 6:04 PM, Mark Wheeler wrote:

Hi Errol,

Yeah, I forgot to put that in the email. After the email gets sent, I did exactly as you stated about unsetting the session variable. The problem that I come up against is that if the spammer loads up the form into a browser window, look at the source code, find the input tag with the token value, plug it into his script and he can get through. Here's what I mean.

1. Spammer loads up my form.

2. Looks at source to get the hidden input tag with the token value in it.

3. Copy and pastes that input tag into his spam script.

4. Opens a new browser window and runs his script.

5. Mail goes through because the token is correct and the session variable is still active.

Does that make sense? Am I over-thinking this?

Mark

You are a bit.  Sending one e-mail at a time isn't helpful to a spammer.  In order to use your script, they would need to fetch the page, get the code and then using the same session (so same cookie in the same browser), execute a post with the form data.  You've already raised the bar for using your site.  If you want to go a step further, you could limit the number of requests to the same page from the same ip in a given time interval.  You could do this by keeping track of the ips or even incrementing a counter in the session since the id is tied to the session.  Remember that multiple users behind the same proxy server or using NAT would not be able to hit your site so make this number fairly large like say 30 in 5 minutes or so.  

Lucas Holt

email@hidden

________________________________________________________

FoolishGames.com  (Jewel Fan Site)

JustJournal.com (Free blogging)

FoolishGames.net (Enemy Territory site)