0

Is there a way to discern if an incoming POST request has been initiated programmatically via cURL, or is a normal HTML POST request?

Can I differentiate between the two in PHP so that I can set a specific condition?

Mirian
  • 9
  • 7
  • A POST request initiated by the client browser, rather than sent via cURL from a server? – Mirian Feb 06 '17 at 12:21
  • There is nothing “un-normal” about either the one or the other. And if via cURL someone sends the exact same request headers as a browser would, then there is no way for you to discern between the two (because of them being _identical_). At most you can check for typical headers/values a browser would send (such as User-Agent, the different Accept-… headers, etc.), and based on that try and guess(!) if you are dealing with a real browser or not. – CBroe Feb 06 '17 at 12:24
  • Gotcha. Thank you! – Mirian Feb 06 '17 at 12:25

1 Answers1

0

if you mean libcurl , i'm pretty sure the answer is no, it adds no identifying information in it's requests by default.

if you mean curl , yeah it's easy. the default useragent is curl/versionumber (on my system right now its curl/7.52.1) 

if(1===preg_match('/^curl\/[\.\d]+/',$_SERVER['HTTP_USER_AGENT']??'')){
//curl's user-agent string. probably curl
} else {
//could be anything (including curl, perhaps with a masked user-agent)
}

a regex may even be overkill, maybe you could just do 0===strpos('curl/',$_SERVER['HTTP_USER_AGENT']??'')

an interesting note is that curl will not execute javascript, so if you add a (hidden?) input tag with javascript, curl will ignore it. like jsInputTag=document.createElement("input");jsInputTag.setAttribute("name","jsInputTag");document.getElementById("form").appendChild(jsInputTag);

curl will not add the jsInputTag to the form (nothing stops a programmer from adding it manually, though.)

but then again, many paranoid people don't run javascript on their browsers either, and most browsers have a way for turning it off.

by the way, if it's an X-Y problem, and what you really need is protection against automated scripts, you should use a captcha, not try to detect curl. for example: ReCaptcha

hanshenrik
  • 19,904
  • 4
  • 43
  • 89