restrict number of page loads per minute by ip

kender

I have a page where some users are abusing "refresh" and loading my pages 20-100 times in 1 minute...
is there a way to count page loads in a 60 second period and say.. "if page load count greater than 10, redirect to google" or some such deal

I am looking for something that wont require database usage, if possible, but i can create a table for it if necessary... a text file, sessions... whatever necessary to get it done

dalecosp

kender;10978705 wrote:
I have a page where some users are abusing "refresh" and loading my pages 20-100 times in 1 minute...
is there a way to count page loads in a 60 second period and say.. "if page load count greater than 10, redirect to google" or some such deal

I am looking for something that wont require database usage, if possible, but i can create a table for it if necessary... a text file, sessions... whatever necessary to get it done

Cookie is a possibility ... set to expire in plus one minute. Also, text file might not be a bad idea. Create a writable directory, maybe in /tmp, and check for the existence of a file, say, "1.2.3.4.txt". If it exists, check [man]filemtime/man and then decide to show the page, or not.

kender

dalecosp;10978768 wrote:
Cookie is a possibility ... set to expire in plus one minute. Also, text file might not be a bad idea. Create a writable directory, maybe in /tmp, and check for the existence of a file, say, "1.2.3.4.txt". If it exists, check [man]filemtime/man and then decide to show the page, or not.

Well, I would like to allow a few refreshes per minute, not necessarilly restricted by a set timeframe.. so.. 5 refreshes in 5 seconds is ok, as long as the 6th doesnt hit within 60 seconds...

but if they refresh every 12 seconds, would i need 5 text files per person?... 5 session variables?

$_SESSION[$x]['IP']['time'] = time();  $x++;

if there are more than 5 $_SESSION[$x] for each IP then check time of oldest, if greater than 60 seconds then destroy it, if less than 60 seconds logout user and redirect ?

bradgrafelman

So how is all of this supposed to work when places like corporations or schools have 1 public-facing IP for literally hundreds of computers?

kender

i can use login name instead of IP... just need a distinction