Web Proxy Automated POST Resubmission for Bot Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for protecting websites and APIs against malicious bots are inconsistent and insecure when handling HTTP POST requests, as different clients handle reloads differently, leading to cumbersome user experiences or data loss.
Innovation Solution
Implementing automated POST resubmission through a web application layer proxy that intercepts POST requests, encrypts the payload, and submits it automatically after token acquisition, ensuring consistent and secure bot detection across various clients without relying on page reloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the technique of sending client to reload page after token acquisition is used, then bot detection is achieved, but POST request handling becomes inconsistent and insecure across different clients
Solution Approach 1:
The patent introduces a proxy server as an intermediary between the client and the web application. The proxy server intercepts POST requests, manages token acquisition, and handles the complex interaction with the bot detector component. This intermediary absorbs the inconsistency of client reload behaviors by centralizing the control flow, ensuring that bot detection reliability is maintained while clients can use their native reload mechanisms without causing security or consistency issues.
2Reliability
If clients are forced to reload page after token acquisition, then identification is completed, but data loss occurs when clients silently convert POST to GET requests
Solution Approach 1:
The patent performs preliminary action by having the proxy server intercept and capture the POST request data before the client reloads the page. The proxy server stores this data temporarily and uses it to reconstruct the POST request after the client acquires the token and reloads. This preliminary capture of data ensures that even if the client silently converts POST to GET during reload, the original POST data is preserved and can be resubmitted securely through the proxy server.
3Adaptability or versatility
If different clients handle POST request reloads differently, then client autonomy is maintained, but security and consistency of bot detection are compromised
Solution Approach 1:
The proxy server acts as a mediator that standardizes the bot detection process across different client types. While clients maintain their autonomous reload behaviors (GET requests show popup dialogs, some clients silently convert POST to GET), the proxy server uniformly intercepts these reload requests, checks for token presence, and manages the bot detection flow consistently. This intermediary layer translates diverse client behaviors into a consistent security verification process.
Data Source
AI summary
A method by a web application layer proxy communicatively coupled between a client and an origin server for performing automated POST resubmission. The method includes intercepting a request by the client for a resource provided by the origin server, obtaining an interstitial page in response to receiving an indication from a bot detector component that the client needs to be identified, where the interstitial page includes challenge code for interrogating the client and code for automatically submitting a form included in the interstitial page if the client successfully acquires a token, encrypting a payload of the request, adding the encrypted payload to a hidden input field of the form included in the interstitial page, and sending the interstitial page with the encrypted payload added to the hidden input field of the form to the client as a response to the request.