How as a web developer I can prevent phishing proxy attack with a tool like Evilginx?


There is currently only one foolproof way to prevent phishing, and that's to use U2F or webauthn. This works because the browser is incorporated into the authentication. It sends the url of the page to the token along with the authentication request, and if it doesn't match the verification will fail when the proxy forwards it to your server. With U2F, since it's a second factor, the user will have already given away their password, which isn't ideal, but the phisher will at least be prevented from authenticating.

As a developer you could force the user to use one of these tools, which can work well in an internal company environment, but it may not be well received for a public facing website. The best you can reasonably do is advertise your support for these mechanisms and inform users of the benefits.


Expanding on the question, you are essentially asking "how to prevent users from going to a phishing website", as there is nothing you can do to prevent this at a technical level. The proxy server would just appear to be another client accessing the website. Even if you were able to provide phishing awareness training to all of your potential users, it is still not possible to prevent all attacks.

Even if it were possible to detect that there was a malicious proxy, the attacker could instead set up a cloned version of the website.

Not the answer you're looking for? Browse other questions tagged or ask your own question.