license checking

importance of retaining Forbid if blank (or "-") Referer *and* UA

[stefan009]

hi all,

I have had the following in htaccess:

# Forbid if blank (or "-") Referer *and* UA
RewriteCond %{HTTP_REFERER} ^-?$
RewriteCond %{HTTP_USER_AGENT} ^-?$
RewriteRule .* - [F]

Now I am trying out a licensing system, the licensing code in the customers php script is falling foul of the above i.e it is being rejected.

the licensing software is trying to access my database to make a validation check.

does anyone know how I can make the customers script not be caught by the above?

Sorry, I am still swatting up on some of this, I really would be grateful of if you need more info let me know.

Cheers!

[jdMorgan]

It seems to me that you need to remove the code, whether or not you get more "intruders" with it removed. Either that, or get the license checker changed to include a user-agent (as it should) and a referrer (if appropriate).

On several sites I have that are subject to a lot of junk accesses, I disallow access if *both* user-agent and referrer are blank, or if either are equal to "-". That's an important point: The use of a user-agent or referrer containing a hyphen is a deliberate attempt to bypass site security measures that disallow blank referrers or user-agents. A hyphen is used because Apache log files will normally contain a hyphen to indicate a blank HTTP request header for either of these values. This masquerade allows the intruder to bypass the blank-check, yet show up in the logs as if these headers were actually blank. Therefore, it should be treated as more serious than a simple blank referrer and/or user-agent:

# Forbid if blank *and* UA
RewriteCond %{HTTP_REFERER} ^$
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule .* - [F]
# Forbid if *faked* blank referer *or* UA
RewriteCond %{HTTP_REFERER} ^-$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^-$
RewriteRule .* - [F]

Blocking blank or faked-blank referrers and user-agents can help to reduce unsolicited e-mail and bandwidth wasted by various site checkers and monitoring "services". But at the point where the blocking routines start interfering with the operation of your site, they obviously need to be reviewed. As usual, you have to ask yourself, "Which approach gives the best cost/benefit tradeoff for my site?

Jim

[stefan009]

# Forbid if *faked* blank referer *or* UA
RewriteCond %{HTTP_REFERER} ^-$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^-$
RewriteRule .* - [F]

The above did work ok.

I'll see about changing the script headers to accommodate the rest.

Thank you Jim.

Of course the initial problem was working out why the licensing system was not working normally in the first place. I expect the rest will be easy.

--Steve

[jdMorgan]

Take a look at your raw server logs after a failed license validation attempt, and see whether the user-agent or referrer (or both) is missing for that access. That will determine your path forward.

Jim