Registering Users 1

[LeeGath]

We are currently implementing a web interface whereby users register themselves, we return a one time only password which they log in and set various security questions.

We have a potential issue where somebody could create a script to fire off thousands of user registrations from one machine and clog up our network. Is there something cute I could do with the log on? Or am I over-reacting and this isn't really an issue?

Thanks

 

[Ballad]

That sounds like it would be disasterous to the "web interface" with one script... Is this a forum that you're talking about? Is there something that could block the client that theyre using to run the scripts? Or am I totally wrong and you dont need a client to run scripts.. Reach us at...

http://www.ballad.tk

,Yang

 

[bgssgk]

If your using IIS I'd limit the submissions based on client IP you can read the IP by using
Request.ServerVariables("REMOTE_HOST&quot
if you get more than say 100 requests (must allow for proxy servers AOL etc) disallow additional requests.
You can also do this with session variables however if they aren't accepting the cookie you would have to say "NO" you must accept cookies.

If you need more help just post, however, I would not be incredibly worried as unless its a bank site, you'll only get script kiddies who are pretty stupid to start with.

Hope that helps

 

[LeeGath]

Unfortunately it is a bank site although it is not a mainstream element and does not directly interface with say current accounts or savings accounts.

Although we are pretty confident the site is secure, because it requires manual authorisation. What we want to prevent is someone sending thousands of requests and slowing the site down. Someone one mentioned changing the tab order of the page so that a script wouldn't work properly. It's a fairly crude method and would probably annoy the genuine users, but I'm not sure of any other options.

I think you have probably confirmed my suspicion that we can get away without implementing a safeguard.

Thanks

 

[bgssgk]

One more thing you might want to consider is reading the referring url on submission of the registration form if it is not the page you have for this process you could deny the request ( you could also check that it is a post request as well) this would probably kill any scripts since a script would go directly for the processing page.

Good luck with your site