Re: Page load frequency

Erwin Moller wrote:

frizzle wrote:


frizzle wrote:
Erwin Moller wrote:
frizzle wrote:

Hi there,

I need a function to prevent a page from being loaded too often too
fast.
So say, one is only allowed to refresh a single page 5 times in 10
seconds, or 10 times in 5 seconds (or whatever ... ).
If the load frequency exceeds that, the site calls exit(); And a
message is displayed. Just like Expression Engine does ...

This way i want to protect the DB from being queried rediculously
often, and maybe even protect it from DDOS attacks.

I hope it's clear. I don't know where to start ..

Thanks!

Hi,

You have to implement some kind of countingmechanism when the page
starts. You can store the timestamp (now) in a database once the page
runs, and check if it has been accessed more than X times last Y
seconds. Just build it. :-)

Of course this check will slow down each request to the page a little,
but if the load of running the whole page is much higher, this may be
worth the time.

Regards,
Erwin Moller

Would this be a good thing to do with sessions ?

Not to be stupid here, but i don't completely get one thing:

Say one can load 5 times in 5 seconds;

If someone loads the page at second 1, and then reloads three times
between second 3 and five, this would be 4 loads in 5 seconds. But if
then he reloads 3 times between seconds 5 and 7, it's 6 loads in (less
then) 5 seconds, though AFAIK your idea would have "approved" this.

How could i fix this?

Thanks!

Hi,

first question: Session.
I was unsure if you wanted to protect against a single user or against all
users.
If you want to protect against a single user loading the page too much,
you should use session, BUT if that visitor wants to circumvent your
sessionlogic, it is easy.
Here is why: If you want to use a session with a visitor you send along a
sessionid with each request and response. The sessionid is stored in the
URL or cookie.
Both can easily be manipulated by the visitor, so this will not really
work.

It would make more sense to use the remote IP-address to maximize the
number of requests to your page.

Second querstion: How to implement the quota X times per Y secs?

just a rouch idea based on IP:
create a table like this:
CREATE TABLE tblrequest(
IPnum text,
lastrequest datetime
)

Now above your script do this:
1) Get the remote IP
Use remoteadress, read more here:
http://nl3.php.net/manual/en/function.getenv.php

2) delete from tblrequest ALL requests older than (now - Y secs)

3) check if this IP has already exceeded the quota:
Something like:
SELECT COUNT(IPnum) FROM tblrequest
WHERE (IPnum = '<IPnum found in step1>');

if the count exceeds X, exit, otherwise continue with the rest of the
script.

Oops forgot to mention the obvious:
of course insert it in the table. :-)

INSERT INTO tblrequest (IPnum,lastrequest)
VALUES ('<IPnum found in step1>','now');

Regards,
Erwin Moller
.

Relevant Pages

  • Re: Page load frequency
    ... Erwin Moller schreef: ... but if the load of running the whole page is much higher, ... first question: Session. ... delete from tblrequest ALL requests older than ...
    (comp.lang.php)
  • Re: (Sloppy correction) Re: session management with database: optimal parameters in php.ini
    ... On 10 mar, 13:21, Erwin Moller ... make it so simple that there are obviously no deficiencies, ... but I never used their db session management myself. ... But you can simply check it yourself with the 20 frames. ...
    (alt.php)
  • Re: Apples customer service sucks!
    ... have a load balancer distribute requests between them. ... break foo.php on server 2 until I've updated it as well. ... BBEdit. ... balancer supports session affinity or that you're storing all ...
    (comp.sys.mac.advocacy)
  • Re: Dynamically adding in User Controls
    ... This would allow me to load or not load depending on values in my session ... that the UserControl is part of the ... Control headerControl = Page.LoadControl; ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Hibernate LazyInitializationException in web application Struts as MVC, Spring as IOC and Hibern
    ... Instead, when you invoke a method of the collection for the first time, it executes an additional database query to load all the objects of the collection. ... In order for this query to work, the object must be associated to an open session. ... Since your toStringmethod probably invokes all the getters it finds on the value object and certainly invoke toStringon the result, Hibernate tries to load the objects in the collection, but your session is closed. ...
    (comp.lang.java.programmer)