Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My site is "under attack" : bots from many different IPs are filling a form with spammy content.

IP addresses can't be filtered, they are always different, so I was thinking to filter by QUERY_STRING, to match an URI like this:

www.site.com/search?field1=spamword&field2=another_spamword

The rule :

rewritecond %{QUERY_STRING} ^(.*)spamword(.*)$
rewriterule .* - [F,L]

The regular expression looks right, but the rule is never executed. Any idea what's going on?

Thank you.

share|improve this question

migrated from stackoverflow.com Jul 26 '10 at 5:39

This question came from our site for professional and enthusiast programmers.

2  
Have you enabled & looked at your RewriteLog ? –  Wrikken Jul 25 '10 at 19:15
    
Just a note: the form I'm talking about is a search form, so no captcha could be used. –  UVL Jul 29 '10 at 14:17

2 Answers 2

up vote 1 down vote accepted

I could not enable the rewrite log, so I have found another way, and did this directly on all the pages with a form:

if ( strlen( $_SERVER['REQUEST_URI'] )>650 ) {
    header('HTTP/1.0 401 Unauthorized'); 
    .. error message to not panic real users ...
    exit;
}

Because I have found ( watching the access logs and considering the form fields ) that an URL longer than 650 characters is never a valid request. (the average size was 4-6 Kb)

Sadly the regex issue is still there, and did not managed to solve it. But at least the issue was partially solved ( the bots are still there, but the page uses very few resources, as no queries are done )

Luckily the bots will recognize the 401 error and desist.

share|improve this answer
    
you can accept your own answer if you solve it already –  Graviton Jul 28 '10 at 13:05

Aside of @Wrikken comment (check the log and see if RewriteEngine is on), the only thing that can be wrong is the regex. Try removing the ():

RewriteCond %{QUERY_STRING} ^.*spamword.*$
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.