Website bot protection

Question

How to allow requests only from the origin? You can easily search the post data fields from the source code. I’ve seen it and done it. Asp sites like sololearn uses hidden inputs with random tokens to avoid this.

Answer 1

This is from existing site

<form action method=”post”>
<input name=”user”>
<input type=”password” name=”pass”>
<input type=”submit” name=”submit”>
</form>

Its a login form.
With python we could make a session request to that address

import requests
data = {
”user”: ”toni”,
”pass”: ”1234,
”submit”: 1
}
session = requests.Session();
session.post(”www.url.com/login.php”, data=data)

Now we are logged in. The session object stores the session cookies. Now you can send posts and comments with your account.

for num in range(0, 10000):
data = {
”message”: ”Msg” + str(num)
}
session.post(”www.url.com/post.php?id=1”, data=data)

You could also register new account. Just send a request to the register form.

If that were the case with sololearn. I could send a request and get all recent posts. I would parse the post url from the links. And automatically like every post or comment on them.

Answer 2

if you extend your description it will be a nice reference in here ^^