Programmer-PHP Website registration when sending SMS interface is simulated POST request brush SMS, how to solve?

PHP website registration When sending SMS interface is simulated POST request brush SMS, how to solve?

Reply content:

PHP website registration When sending SMS interface is simulated POST request brush SMS, how to solve?

There are two kinds of I know:
1, on the page plus csrf_token,php CI framework are for this.
2, Access frequency limit, (with IP restrictions, same number restrictions) and so on.

Change to have tokens to send text messages. For example, add a picture verification code.

Add a limit, can only be sent once a minute, a maximum of 50 times a day, which is the practice of most sites.
csrf_tokenIt is not impossible to break, I can use the software to first visit the generated token page to get it.

One request token, valid for once, set the expiration time. That's what I'm doing right now. Token verification failed, missing, is illegal commit. If you're more insured, refer to what your buddies said. are very common means of listening to other buddies ' opinions.

1, front-end plus token (graphics validation)
2, set the 60-100-second request interval with the number.
3, set the number of requests within one day (6-8)
With IP not recommended limits, the above 3 steps can block most of the robot,
The last step, you can consider HTTPS transmission
Also recommend a developer-specific SMS api:www.shsixun.com

Currently on the market, there are several new types of graphic verification scheme, or good, you can look at this: Https://luosimao.com/service/captcha

