Forum Moderators: phranque
Ok, I know this is old news but I just learned about it today. These proxy sites that allow you to surf anonymously not only frame your page but modify the code on your page. The modify your framebusting scripts also, making them useless. I was able to use these sites to look at google and even this site with no problem. All must not be hopeless though, I tried viewing different proxy sites with the other proxy sites and what do you know, they redirect to google.
If they have figured out a way to stop other proxy sites from framing themselves, their must be a way to stop them from framing and modifying my pages. I mean a way beyond simply banning IP addresses.
This really bugs me, it would be nothing for one of these websites to simply modify your advertisers code. I haven't found one that does it yet, but I imagine they must exist.
I changed just my homepage link to this,
<script type="text/javascript">
document.write(\'<a hr\'+\'ef="http://example.com/">Home<\/a>\');
</script>
The hijacking website doesn't see the "href" and so doesn't modify it. I figure a link to "http://example.com/" not being spidered isn't a big deal either. So if anyone that comes across my website in a frame and uses the home link it will break the frame. Downside is, if someone has javscript disabled my home page link disappears.
Looked at one solution, not sure I want to block google but hopefully I can figure out a way to just deter the framers.
So, the first step is to study access.log, and even setup a cgi to log entire header.
Possibly, simple IP based blocking will do.
<body onload="if(location.href.substring(7,location.href.lastIndexOf(\'.\'))!= \'example\') top.location.replace(\'http://example.com/\');">
I started a thread at the javascript forums, so if anybody wants to help or knows of a better script, heres the link,
[webmasterworld.com...]
I wrote it in shellscript (as it's small and fast), but we can easily write something similar in Perl/Python/PHP/whatever, too.
But again, you've got to know the detectable access pattern of them (or anyone you don't want).
That's why I said the first thing you should do is studying the access.log.
Note:
If your site is dynamically served by scripts, detection code can be placed in them.
It's easy to detect excessive/aggressive accesses.
This would be useful to determine, for example, if the %{HTTP_X_FORWARDED_FOR}, %{HTTP_VIA}, or %{CLIENT_IP} headers are present -- a good sign that the request is via proxy. If so, then the %{REMOTE_ADDR} can be blocked, unless it's AOL or some other well-known ISP that uses proxy servers in their networks.
Jim
