Allow only browsers to access my site

alexei999

hi there,

what are the most popular browsers on the web today?

I'm wondering if there is a quick way to:
Allow only most popular browsers to access my website.

I want everybody who uses AOL, MSIE, Netscape, Mozilla, and whatever the rest of this list is - to be able to access the site.

I don't want any application which is not a web browser to access the site.

Like an additional step to prevent hackers attacks by not allowing to access the site for any requests that come from any application, but not a web-browser.

Thanks,
Alex.

tomhath

There are ways to secure your web site, do a little research on the topic. Attempting to block non-browsers won't work since a cracker can spoof the information he sends you.

the_Igel

As your server receives an http request it knows no more than the client tells him. any hacker can pretend to be MicroSoft Internet MegaBest Explorer 2000#.alpha and you cannot check whether he is or not.
So no use.

alexei999

What should I be looking for?

alexei999

some people get pissed off when they receive a spam mail and they create a simple script to post some info into the credit card processing script - reason why - every time scipt executes - there is a loop for let's say 10.000 requests for a credit card transaction. and every single time i have to pay processing fee (when it declines the info about the card or address) processing fee is 0.25cents .. so it can cost me something like:
10.000 transactions * 0.25 = 2.500$

thanks

the_Igel

I think it should be smth like $USER_AGENT.
But if you're afraid of some maleficial scripts, you'd better not rely on agent detection (for reasons listed on the thread). It's really hard to defend against such an attack, and I'm no guru in it. These are serious security questions, in line with DoS etc (the scenario you described is nearly a DoS attack).

alexei999

So what do I do to get around these DoS attacks ?
does anybody know ?

the_Igel

go to Google. Type "web server security" or "server protection". Read.

It's more for server admin than for php-programmer. Of course, you can do some precautions, but i'm afraid that everything you can do won't stop really evil hacker. Protecting from disappointed visitor - yes, sure: ip detection, cookies, etc. But against real hacking - i'm afraid, not many chances.

alexei999

the problem is that i am the server admin as well as php programer ..

doesn't that sound scary ? 🙂))

the_Igel

Yeah. That was an old joke smth like this:

A guy meets his friend and complains about a program that doesn't work or smth of the kind. "This crap", - sais he, - "shows me message about an error and tells me to ask a sysadmin for help". "Then what's the problem?" - answers his friend. - "Just go and ask him". "The problem is", - replies first, - "that I am the sysadmin".

If you are sysadmin, then it's me who should ask about security matters, not you 🙂.
Anyway, searching the web for "security" and "protecting server" etc. is a good start. It will keep you busy for years 😉

jc94062

If your credit card form is being hit over and over again by someone then add in some code to grab the IP thats hitting the form.

After, say, 10 hits from the same IP block that IP from submitting the form again.

Its not going to stop someone getting another IP and hitting it again, but its going to make it much harder and require whoever is causing the problem to spend a lot more time costing you money.

hometoast

You could also generate a text string in a jpg with the GD library and have the user enter that code. Like yahoo and some other sites do to prevent robots from creating email accounts.

metin

some people get pissed off when they receive a spam mail ...

First of all - don't send spam!

... anyway,
one solution could be to let your "credit card form"-script to check if the
request originates from say a given (other) page on your site - if not,
then transfer the user to that page where he has to click on link to access the form.

prasit

Originally posted by alexei999
some people get pissed off when they receive a spam mail and they create a simple script to post some info into the credit card processing script - reason why - every time scipt executes - there is a loop for let's say 10.000 requests for a credit card transaction. and every single time i have to pay processing fee (when it declines the info about the card or address) processing fee is 0.25cents .. so it can cost me something like:
10.000 transactions * 0.25 = 2.500$

thanks

you called people who do this as an evil. who do you think you are when you spammed their e-mails?