-1

I am implementing quick checkout in my e-store.

Customer only have to enter email and phone number to make an order, system checks whether customer with such fields already registered, if not it automatically registers as new customer and completes the order.

So, there is no session, no cookies or tokens. The problem is obvious, someone can just send thousands of requests to make an order and this not only will make server unavailable but create a lot of data in DB.

What is the best way to protect from such attacks ? Using something like nonce or CSRF token won't save from attacks because they are not tied to the session, the is no session.

Please suggest the best way to protect from attacks in my case.

  • Why? What are you trying to achieve? If you know a better way of carrying out e-commerce than amazon, ebay and ali-baba, why do you need our advice/opinions? – symcbean Nov 11 '16 at 20:36
  • Are you expecting an authorization-less system to be secure, or are you accepting that people will (intentionally and unintentionally) create orders under other people's accounts? – Xiong Chiamiov Nov 11 '16 at 21:10
  • if you want to protect from attacks, you need to protect from attacks instead of doing what you're describing. – dandavis Nov 11 '16 at 21:46
  • So you are saying if I know someone's email address, phone number, and that they have been a customer at your e-site, I can make unlimited purchases tied to their account? Your email address and phone numbers typically are known to many people who aren't authorized to make purchases on your behalf. This seems a much more pertinent fear than your worries of DDOS. (I also suspect other issues with this setup). – dr jimbob Nov 11 '16 at 22:11
0

The problem is obvious, someone can just send thousands of requests to make an order and this not only will make server unavailable but create a lot of data in DB.

Trivial. Solved with CAPTCHA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.