且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

Web服务器如何检测重放的登录尝试?

更新时间:2023-08-31 17:30:34

服务器无法神奇地判断他们是否在与Fiddler交谈。

Servers cannot magically tell whether they're talking to Fiddler or not.

如果Fiddler和您的客户端发送完全相同的请求,则表示相关服务器在其登录表单中使用一次性令牌(有时称为nonce)。如果服务器再次看到相同的令牌,则拒绝登录。有时nonce不是直接发送的,而是用于计算质询 - 响应,如NTLM等身份验证协议中所发生的。在其他情况下,nonce是CAPTCHA,这有助于防止您使用机器人自动登录到这样的网站。

If Fiddler and your client are sending the exact same requests, that means that the server in question is using a "one time token" (sometimes called a nonce) in its login form. If the server ever sees the same token again, it rejects the logon. Sometimes the nonce isn't sent directly, and is instead used in the computation of a "challenge-response" as occurs in authentication protocols like NTLM. In other cases, the nonce is a CAPTCHA, which helps prevent you from using a bot to automatically log in to a site like this.

除非您可以分享更多详细信息目标站点(或登录过程的SAZ文件),人们不太可能帮助你。

Unless you can share more details of the target site (or a SAZ file of the login process), it's unlikely that folks will be able to help you.