可以使用http Referrer或其他环境变量来阻止IIS上的垃圾邮件机器人吗？

Question

I am using asp.net. I have a public form that users can create new accounts on, that sends out a verification text message to the user's phone when they hit submit. I don't want spam bots sending out these text messages that cost me money by posing as users.

It is my "guess" that a spam bot or script has to screen scrape the html from the page and find the javascript function that will send this info out via ajax to an asp.net page that sends text messages out. It can't just call and execute the javascript in place and on my server like my javascript does with real users and button clicks, so instead it will execute on whatever server or computer their script is running on and insert the values it got from screen scraping and make a get request or post to the correct url, and that computer or server ip address that the script is running on should show up as the http referrer.

Is that true?

If so, then can I check the http referrer variable when my asp.net page that will send the text message out gets invoked? I'm thinking that if spam bots work the way I think, and they are actually executing a script that mimics the javascript calls on the page but they are not due to user clicks, the script would have to be executing on another server or domain.

Is that true?

And can a script spoof the http referrer variable?

Answer 1

The Referer header should not be used for anything whatsoever. Not only can it be spoofed by scripts (or any custom clients) as well as browsers (using browser extensions), but relying on it can also break your site for legitimate users using browsers. Some users use browser extensions to deliberately suppress the Referer header for privacy reasons, and even some proxies strip referer for security reasons.

See also In what cases will HTTP_REFERER be empty