How to prevent a website from being accessed by a malicious reverse proxy (anti-website mirroring)_PHP Tutorial

What is a reverse proxy?

Let’s first talk about the concept of forward agent:

Forward agent, also known as the legendary agent, works like a springboard. To put it simply, I am a user and I cannot access a certain website, but I can access a proxy server. As for this proxy server, it can access the website that I cannot access, so I first connect to the proxy server and tell it that I need the content of the website that cannot be accessed. The proxy server will retrieve it and return it to me. From the website's perspective, there is only one record when the proxy server comes to retrieve the content. Sometimes it is not known that it is the user's request, and the user's information is also hidden. This depends on whether the proxy tells the website or not.

The conclusion is that the forward proxy is a server between the client and the origin server. In order to obtain content from the origin server, the client sends a request to the proxy and specifies the target (origin server) , and then the proxy forwards the request to the origin server and returns the obtained content to the client. The client must make some special settings to use the forward proxy.

So what about the concept of reverse proxy?

For example, a user visits the page http://www.nowamagic.net/librarys/veda, but www.nowamagic.net does not actually exist. He secretly accesses the page from another server. Get it back from the Internet and spit it out to the user as your own content.

But users don’t know, this is normal, users are generally stupid. The server corresponding to the domain name www.nowamagic.net mentioned here has a reverse proxy function.

The conclusion is that a reverse proxy is just the opposite. It acts like the original server to the client, and the client does not need to make any special settings. The client sends a normal request to the content in the reverse proxy's namespace (name-space), and then the reverse proxy will determine where to forward the request (original server) and return the obtained content to the client, like these The content is its own original content.

The harm of malicious reverse proxy

What are the harms of a website being maliciously reverse proxy? Here are some examples:

•First of all, it will definitely occupy server resources and affect the website opening speed.
•Secondly, if someone else steals your website data through a proxy, for users and search engines that are not so smart, it is equivalent to building a site exactly like yours. Then it is very likely that your site will be included in the search engine sandbox. Box, even demoted.
•If the malicious proxy page also has your affiliate advertisement (such as Adsense), this is very dangerous. If someone clicks on the above advertisement, it is easy to be banned by Adsense.
•There are many dangers, readers can figure it out on their own...

JS level solution

Copy code The code is as follows:

The script is very simple. If the URL in the address bar is not one of nowamagic.net and www.nowamagic.net, then redirect the address bar to http://www.nowamagic.net/. This code can also prevent people from using reverse proxy technology to "fake" a website that is exactly like your own.

Off-topic: How to prevent websites from being embedded by iframes. Some people use iframes to create a framework and embed our website into it. When visitors come to browse, it seems like they are browsing their own website. So how to solve it? The following methods can be broken:

Copy code The code is as follows:

php level solution

Although js-level solutions can make malicious proxy pages jump back, they are not very friendly to search engines. The following is a server-side (PHP) solution. The code is relatively simple, so I won’t go into details.

Copy code The code is as follows:

$proxy_rs = $this -> proxy_filter();
if( $ proxy_rs != 'nowamagic.net' || $proxy_rs != 'www.nowamagic.net' )
{
echo 'Illegal reverse proxy access';
//header('Location: http: //www.nowamagic.net/');
exit;
}

public function proxy_filter()
{
/*
$svrUrl = 'http:/ /' . $_SERVER['SERVER_NAME'].$_SERVER["PHP_SELF"];
if (!empty($_SERVER["QUERY_STRING"]))
{
$svrUrl .= "?" .$_SERVER["QUERY_STRING"];
}

return $svrUrl;
*/
return $_SERVER['SERVER_NAME'];
}

htaccess level solution

.htaccess

Copy code The code is as follows:

RewriteEngine On
RewriteBase /
php_value auto_append_file proxy.php

proxy.php

Copy code The code is as follows:

$f = getenv("HTTP_X_FORWARDED_FOR");
$server = getenv("HTTP_HOST");
if (($f!="")&&($server!="nowamagic.net")&&($server!="www.nowamagic.net" )){
echo 'This server prohibits malicious reverse proxies! ';
}
?>

Due to the particularity of my website, I have not tried this method, but this method is commonly used on the Internet.

Apache httpd.conf level solution
I haven’t figured out how to ban this on Apache. Nginx is fine, but I use Apache. If you know, please tell me~

http://www.bkjia.com/PHPjc/743147.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/743147.htmlTechArticleWhat is a reverse proxy? Let’s first talk about the concept of forward agent: Forward agent, also known as the legendary agent, works like a springboard. Simply put, I am a user and I...