I am currently encountering a publically available interface; accessible at least via web form/webviews and some stateless protocol (presumably REST). In the past this form allowed you to view your booking history without an account, by entering your last name, a booking id and a shared secret derivable from the id with which you booked.

Due to legal changes this shared secret may not be used anymore. Thus the interface now only asks for name and id, which I deem open to guessing attacks. Due to legacy devices it is not possible to introduce new metadata that are required.

I know the OWASP recommendations for slowing down guessing attacks (Slow down online guessing attacks and also Blocking brute force attacks). However, all of these recommendations require an account system present.

Blocking based on IP does not help against modern, proxy-implementing, attack tools. Also it might block a lot of users hiding behind bulk IPs (cable, big companies...).

I thought of adapting the device id cookies. Normally you have the protection of an account system. Maybe it helps to slow down the creation of a device id cookie and then lock users based on this. This way every request of a blocked user would be a lot slower than just firing the form requests and repeated legit requests would be slow.

Are there any best practices for protecting anonymously usable web forms/services? I am quite familiar with mechanisms where an account system is present, but this is new to me.


  • 'session management' is your search term
    – schroeder
    Jun 27, 2017 at 9:44
  • Thanks, but with combinations of session management, anonymous, brute force and guessing I did not find any recommendations, best practices etc. They all rely on authentication or refer to anonymous access to public information (i.e. web pages). I'm afraid my best bet is still that someone reads this question and refers to something specific. I'll also be glad if you prove me wrong or stupid by showing that those keywords indeed lead to best practices.
    – Draugr
    Jun 27, 2017 at 9:55
  • Your session key becomes your de facto authenticated session ID - and then use the same design models to apply the best practices you already identified.
    – schroeder
    Jun 27, 2017 at 10:01


You must log in to answer this question.

Browse other questions tagged .