Question

I am programming a website where you can post stuff. This works with the following jQuery ajax:

    $.ajax({
        type: 'POST',
        url: 'action/post.php',
        data: 'posttext='+posttext+'&imageurl='+imageurl,
        success: function(feedback){
            $('#feedback').val(feedback);
        }
    });

Now I wonder: anyone could write his own ajax to post something to the site and do this over and over again. How do I prevent this? I am sure I would need some kind of security check in post.php – I already heard about http referer, but that can be modified so it’s not really trustworthy.

Also I would like to add a timer in post.php that makes sure that a post from the same ip address can only be posted once every x seconds, and resets the timer if the post is sent below x seconds (kind of like stack overflow does it with the comments).

Does anyone know how to secure the ajax and also how set the timer? Or any other ideas how to secure the posting mechanism?

Thank you!

Dennis

Answer 1

Your best approach would be to store your information in a database. You could have 4 fields in a table:

ipAddress, submitDate, postText, imageUrl

Upon submission, check if there’s an entry in the DB for the current IP Address. If so, compare the entry’s submit date with the current date and if it is over your threshold allow the submission. Otherwise, issue an error message and redirect the user back.

This still isn’t foolproof however, since the IP Address can also be spoofed or the user can be hiding behind a proxy.