Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My website is being nuked by new signups and new posts some of which don't even have user.id associated with.

How do I solve this? What code should I add to the user#new page and/or post#new page.

If it would help, please check my repo: https://github.com/nixor/cpblog

share|improve this question

closed as too localized by Terry Chia, this.josh, Scott Pack, Iszi, Jeff Ferland Dec 3 '12 at 23:55

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
you posted your project without posting the location of the vulnerable code. I'm going to dig around in your project. You should be more helpful. –  Rook Dec 2 '12 at 0:55
2  
Also who cares if they use curl, they could be using netcat or python httplib. That doesn't matter. –  Rook Dec 2 '12 at 1:07

1 Answer 1

up vote 2 down vote accepted

I have not looked into your code, but the things I would do are:

  • checking the eligibility of the user to do anything on your website before making that user makes an action. (If somebody posting something without even registering in the site - it is no good).
  • to prevent from the new signup the common practice is to confirm yourself using a mail account or an account from high profile resources google acount, fb account.
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.