Re: Combatting automated download of dynamic websites?

[Javier Fernandez-Sanguino <jfernandez () germinus com>]

Eoin Keary wrote:

> Should the webapp not have a session variable to record a users
> progress. So a isSessionValid() method would see if the user has gone
> through the correct steps in order to access the info?

You could program a robot to obtain a valid session or even feed your 
session to a robot.

> Each session entry could be time stamped in order to implement
> throttle functionality.

Session timestamping does not mean that it will throttle, does it?

> Also limiting by IP may cause issues for people behind firewalls?

Depending on the number of requests you implement as a limit, as I 
said, you need to monitor when your IP throttle blocks uses and try to 
investigate if they are behind a proxy or a NAT barrier (i.e. a 
firewall) to increase the number, if you want to, on a per IP basis in 
order to prevent blocking legitimate customers.

As any blocking security measure, you need to make sure you control 
when it gets trigered to avoid false positives.

Regards

Javier