How to prevent a website from being accessed by a malicious reverse proxy_PHP Tutorial

Recently, someone used small site data and reverse proxy technology to create a thief site. The user visited his URL, but the content data is actually mine. This is a malicious reverse proxy incident

What is a reverse proxy?​ ​ Let’s first talk about the concept of forward agency: ​ The forward agent, also known as the legendary agent, works like a springboard. To put it simply, I am a user and I cannot access a certain website, but I can access a proxy server. As for this proxy server, it can access the website that I cannot access, so I first connect to the proxy server and tell it that I need the content of the website that cannot be accessed. The proxy server will retrieve it and return it to me. From the website's perspective, there is only one record when the proxy server comes to retrieve the content. Sometimes it is not known that it is the user's request, and the user's information is also hidden. This depends on whether the proxy tells the website or not.​ ​ The conclusion is that a forward proxy is a server between the client and the origin server. In order to obtain content from the origin server, the client sends a request to the proxy and specifies the target (origin server), and then the proxy sends the content to the origin server. Hands off the request and returns the obtained content to the client. The client must make some special settings to use the forward proxy.​ ​ So what about the concept of reverse proxy?​ ​ For example, a user visits the page http://www.nowamagic.net/librarys/veda, but www.nowamagic.net does not actually exist. It secretly retrieves it from another server and uses it as its own content. spit to the user.​ ​ But users don't know this. This is normal. Users are generally stupid. The server corresponding to the domain name www.nowamagic.net mentioned here has a reverse proxy function.​ ​ The conclusion is that a reverse proxy is just the opposite, it acts like the original server to the client, and the client does not need to make any special settings. The client sends a normal request to the content in the reverse proxy's namespace (name-space), and then the reverse proxy will determine where to forward the request (original server) and return the obtained content to the client, like these The content is its own original content.​ ​ The Dangers of Malicious Reverse Proxies ​ What are the dangers of a malicious reverse proxy on a website? Here are some examples: ​ •First of all, it will definitely occupy server resources and affect the website opening speed.​ •Secondly, if someone else steals your website data through a proxy, for users and less intelligent search engines, it is equivalent to building a site exactly like yours. Then it is very likely that your site will be entered into the search engine sandbox, or even Demoted.​ •If the maliciously proxied page also has your affiliate advertisement (such as Adsense), this is very dangerous. If someone clicks on the above advertisement, it is easy to be banned by Adsense.​ •There are many dangers, readers can figure it out on their own... ​ ​ js level solution The code is as follows: ​ ​ The script is very simple. If the URL in the address bar is not one of nowamagic.net and www.nowamagic.net, then redirect the address bar to http://www.nowamagic.net/. This code can also prevent people from using reverse proxy technology to "fake" a website that is exactly like your own. ​ Off topic: How to prevent websites from being embedded by iframes. Some people use iframes to create a framework and embed our website into it. When visitors come to browse, it seems like they are browsing their own website. So how to solve it? The following methods can be broken: ​ The code is as follows: ​ ​ PHP level solution ​ Although the js-level solution can make the malicious proxy page jump back, it is not very friendly to search engines. The following is the server-side (PHP) solution. The code is relatively simple, so I won’t go into details.​ The code is as follows: $proxy_rs = $this -> proxy_filter(); if( $proxy_rs != 'nowamagic.net' || $proxy_rs != 'www.nowamagic.net' ) { echo 'Illegal reverse proxy access'; //header('Location: http://www.nowamagic.net/'); exit; } ​ public function proxy_filter() { /* $svrUrl = 'http://' . $_SERVER['SERVER_NAME'].$_SERVER["PHP_SELF"]; if (!empty($_SERVER["QUERY_STRING"])) { $svrUrl .= "?".$_SERVER["QUERY_STRING"]; } ​ return $svrUrl; */ return $_SERVER['SERVER_NAME']; } ​ ​ htaccess level solution ​ .htaccess ​ The code is as follows: RewriteEngineOn RewriteBase/ php_value auto_append_file proxy.php ​ ​ proxy.php The code is as follows: ​ ​ Due to the particularity of my website, I have not tested this method, but this method is commonly used on the Internet. ​ Apache httpd.conf level solution I haven't figured out how to ban this on Apache. Nginx can do it, but I use Apache. If you know, please tell me ~

http://www.bkjia.com/PHPjc/743296.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/743296.htmlTechArticleRecently, someone used small site data and used reverse proxy technology to create a thief site. The user visited his website, but in fact the content data is mine. This is a malicious reverse proxy incident...