Ibrahim Tanyalcin

{intrst:"Scnc&Art",msc:"admin@MutaFrame",strive:"Experiment&Learn",loves:"ES5",hates:"bandwagon",lang:"Javascript",twttr:"@ibrhmTanyalcin"}

Jan 21, 2018

Edit: I did not see the node tag there. So I will remove part of my answer in php. Sorry!

If you want to identify if the call is from js:

set a custom header within your application and check it on the server side
set a cookie by js, since it will be sent to server check it again there
sniff the user-agent header (something like below):

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36

Before the request, make the client do a ajax/fetch request by js, on server side set a cookie, and on the next request (the real one) check for the presence of this cookie (it can be string/hash that follows a certain rule etc.)

You can use 1 or all of the above points and combine it with the host name if you want. These are some points that came to my mind and I am sure there is many many more.

BUT, if you are not really offering some secure information (about people's identities) please let people scrape your website as they want. Because internet is a free environment. A tech savvy person can circumvent almost 99% of the measures taken. And DDoS is really really difficult to prevent after all.

TheSheriff

Co-Founder, Founder, Entrepreneur & Problem Solver

Jan 22, 2018

Servers can emulate cookies and user-agent.

I see that you don't have the habit of reading a reply from start to end. Quote from my reply:

A tech savvy person can circumvent almost 99% of the measures taken.

Btw, one of the last bullet points was to initiate an ajax request to receive a cookie generated from the server side and use this cookie for the next real request. IF the former cookie is a hash of combination of:

request time + host-name + user-agent + IP

then you have to at best do 2 requests to receive the first cookie and then make the other one.

If they require you to send a form id attached to the first request (to see if it's done from js) then you will need to grab that one too to receive the first cookie, maybe through a headless browser

If some client side modification is done to the first cookie within JS, then you will need to replicate the same manipulation too. (if the untouched and manipulated cookies are same length md5 hash, there is no other way to unobfustucate the minified js and see how they transformed the hash)

This can keep someone busy about an hour. If you have better solutions share.

Search Hashnode