I want to create a quiz on the web. Everybody can enter documents and play as much as he wants. No registration required. User just needs to fill in telephone number and answer 2 questions.BUT !! I want to prevent that some computer nerd writes an agent that creates documents every 2 secs.
Last year this was done in different technology and we had about 200.000 entries.
My first line of thinking : Put a field on the form which does not allow saving before 10 secs have passed.
Comp := Comp;
@If(@Now <@Adjust(Comp;0;0;0;0;0;10);@Failure(“No Save”);@Success)
This works in Notes, but not on web since @now does not work.
Does anyone know an alternative for @now on the web??
My second line of thinking was to check in a view (with selection formula all documents created the last 3 minutes) if there was a doc with the same tel number. I’m afraid the refreshing of this view will seriously impact my server performance.
Any ideas are welcome
Subject: Web quiz - prevent automatic creation of documents
Some ideas –
Use javascript to enforce the delay – save current time via the Date object in the onLoad, compare in the onSubmit.
Save IP of user (CGI variable Remote_Addr) and only allow x entries per user. You can calculate the SaveOptions based on the result of an @DBLookup. I really don’t think there will be any performance issue from refreshing this view. IP is better than phone # since a bot/script can just enter a new phone # each time.
I’m sure there are dozens of more ideas, but I hope this helps…
JLT
Subject: RE: Web quiz - prevent automatic creation of documents
I agree with ip instead of tel# but"Use javascript to enforce the delay – save current time via the Date object in the onLoad, compare in the onSubmit"
If I wanted to fill up his db I would use a direct http POST i.e no page to load, no js, no preset fields.
Subject: HTTP POST questions…
Haydn –
Interesting… if the “agent” is filling the database via a direct HTTP POST, then where do you even put the code to perform a check? Will the WebQuerySave event be triggered based on the form name?
I guess I’m not much of a hacker, so I really wouldn’t know how to actually do a direct http POST. If this is that easy to do and Domino can’t detect such a rougue request, then aren’t most/all Domino db’s compromised in this way?
The original question referred to @Formulas, so I assummed there would be a form involved.
Subject: RE: HTTP POST questions…
Its quite easy to perform a http post eg using vb and the ms http object. However for domino to accept it, there must be a valid form name in the request content and domino validates the received data against the form and generates a WQS event if required by the form.And yes, all web sites, not just domino, can be ‘attacked’ in this way.
Subject: Conclusions
Thank you all for your cooperation in this interesting discussion.
I think I will go for a form containing some javascript to set and check time, check the IP address, write a delete agent for the excesses, and especially do not tell anyone the site exist :-).
I’ll let you all know when the quiz starts (first prize : trip to Eurodisney. (You have to live in Belgium though)
Cheers,
Big B
Subject: RE: HTTP POST questions…
To answer – yes, the form is invoked, even with a ?CreateDocument URL (as opposed to ?OpenForm&Seq=1), but that doesn’t help a whole lot since the POSTing agent does not need to wait for a reply. Instead of getting thousands of unwanted documents, you get a server that can’t answer legitimate HTTP requests due to traffic (DOS attack). This is NOT a Domino failing – any HTTP/HTML platform is succeptible to the same abuse because of the stateless nature of HTTP.
Subject: RE: HTTP POST questions…
doesn’t the firewall solve these denial of service HTTP POST’attacks ? Any idea how Lotus/IBM tracks these. If this is a known problem, you could expect some crazy MS guy bombarding this forum with stupid MS questions.
Since this forum hardly ever gets corrupted, I suppose some defence is active?
Subject: RE: HTTP POST questions…
There are folks who would tell you that this forum is already bombarded with stupid questions, and that MS does not have to be involved at all. This forum is authenticated (even if the id used is false, one still needs to register and use the id to create documents), so server security and the ACL handle anonymous blitzes. The original post, though, referred to anonymous entries.
Subject: RE: HTTP POST questions…
“This forum is authenticated (even if the id used is false, one still needs to register and use the id to create documents), so server security and the ACL handle anonymous blitzes”
Yes but once I’ve registered under a false name my app can login at http level using the correct name&password and start a DOS attack.
Anything I can do with a browser I can automate and do much quicker.
Subject: RE: HTTP POST questions…
True, and if there were a postings-per-day limit, then folks like you, me, and the rest of the folks on the “spend far too much time in here” list would have been booted long ago ;o)
Subject: RE: HTTP POST questions…
but then I could not ask my stupid questions!
That is why I think you should HAVE to submit a safe copy of a Notes ID to use the forum.
But then I could not be “File Save” and I would have to become “File Deleted”
Subject: RE: HTTP POST questions…
You can get around all of this by POSTing the form results to an agent instead of using the built-in submit button of the form --The agent can parse the submitted data out of the CGI variables, and you can check against the existing IPs before ever saving it. And this will work against people trying to automate responses because they cannot skip this server-side processing.
It will be a heavier load on the server, and does not prevent DOS issues mentioned later in this thread, but those are really minor issues in the grand scheme of things.
Subject: Web quiz - prevent automatic creation of documents
You are probably right that having a view with selection formula ‘all docs created in last 3 minutes’ would create a heavy load on the server. Articles on view performance seem to generally discourage selection formulae based on current time.
A better way would be to have a view sorted by telephone number first, and date/time of entry second. That would enable you to directly look up the time of the user’s last entry and disallow saving of the new entry if it was too recent. Alternatively, you could easily look up how many entries they had already submitted, or, using the first and last entries, work out the average rate of submitting them.