One of the most common attacks on Web applications is called spoofing forms. It happens when a malicious user performs numerous posts followed from an unmapped site. This makes it possible to bring down a server, since a high number of simultaneous requests can, at any given time, prevent its operation.

The word ‘spoof’ was originated from a British comedian named Arthur Roberts (1852-1933), who invented a game called Spoof involving “artifice” and “absurd”. The word spoof was first recorded in 1889, also with the meaning of “deceive”. As a result, they are now less widely used than in the sense of “parody” or “satirical imitation”, first recorded in 1958, and in order to “satirize gently”, first recorded in 1927.

Spoofing attacks can happen in any type of web application or site. Therefore, the form should have applied a number of practices that protect this kind of attack.

The first preventive measure against spoofing attack is the use of session validators. The so-called captchas protect posting form, forcing the user to resolve an issue before the information was effectively persisted in the database.

Simpler robots, those responsible for the automatic postings, cannot solve complex logical problems. Thus, the implementation of a simpler capctha could already solve the problem if there were no more intelligent robots. Some of them have a capacity of more than troubleshooting, but their cost of acquisition and production cannot compensate for the users who do not have a clear intention.

In PHP, you can still implement a control per session where a token can be used to validate that the posting of the session is the same user session logged into the system, as shown in the example below:



if($_SESSION[‘token’] == $_POST[‘token’]){

//valid post



$_SESSION[‘token’] = md5(time());

//add the token in a hidden input


With a single block, validating each step of the session you can ensure that the spoofing attack is not finalized.

Finally, it is concluded that good security practices implemented over the code ensures a much safer application and thus more quality and useful life to the system.

Check out more content on our blog!
Learn all about Scriptcase.

By ,

October 7, 2015


You might also like…

Low-code: Simplifying Development Without Sacrificing Quality

In today's agile and competitive world, productivity is crucial for the success of any business. Th...

Web Systems 101: Understanding the Fundamentals and Benefits

In today's digital age, web systems have become integral to our daily lives. These systems connect ...

6 reasons to demystify Low-code

Low-code has become an increasingly popular approach for software development, but certain misconce...

You might also like…

Get new posts, resources, offers and more each week.

We will use the information you provide to update you about our Newsletter and Special Offers. You can unsubscribe any time you want by clinck in a link in the footer of any email you receive from us, or by contacting us at Learn more about our Privacy Police.