Stopping Malicious Actors

user. But if you were to try to create a new user without the token, then you're going to have a bad time. Kind of like when you go to winter carnival with my kids this weekend because

Right? So, like, you're there. You're able to play, but you don't have tickets. So, like, we had to okay. We have to go to this the thing, get a ticket, and come back and say, alright. Now I have the ability to do that.

I I don't know. That's it. So I yeah. I just say I say nots, but, yeah, Nuance is kind of no. I think nots is the is the actual word. What these are and then they, Also, you can limit by cookie. So that's another one is that if you don't want to limit by IP, you can say, all right, And you to that API, you you give it a username and a password.

I I think

That that request.

I always Yeah. I always say nonce. I don't know if that's actually how you say it. Once. Like, you can do it once.

Yeah. That's often how you see payment processors work too. Right? You hit your payment API. You get the nonce. You send that nonce to the server, and then the server can process

That the token it can decrypt the token and and make sure that that is a token that was issued.

of forward slash Someone can submit directly to your API. So, we've talked about this many times in the past. We've had a shows on how to do this. People will open up the network tab and look at what API endpoints you are using and try to reverse engineer all the documentation that is doing some bad Stuff you're going to get kicked off on notes so quick. But there there is a lot of, like, kind of underbelly

new user.

So c s r f or x s r f tokens that's certainly Doing things they don't know necessarily had know how to clear their cookies or something like that. Yeah, totally.

Exactly. And it's the server oh, we we should say it's the server is expecting

cross site Request forgery.

to go ahead and create a new, pinging it pinging your bank account from Facebook or something like that.

it. Get a

Yeah. 1010 for it. And if they have access to that, it's not necessarily a bad thing because that's how websites work. It's all it's all public. But If they can use that API directly,

Yeah. Yeah. Exactly. So, you talk about malicious actors. Somebody comes to your website, and they want to abuse the features you have and that form pings your API

maybe increase some sort of conversion for them or something. I mean, there's always some sort of reason why they're doing these things, and it's not good for you or your users, but See here is potentially at fault. So how do you stop these people from

what are bad things that can happen? So someone can submit a form over and over and over again or or literally just Run up your database so the thing falls over.

spam comment just on on just about every single YouTube video I post, and they're all from different accounts. So there's tons of malicious actors out there hitting all sorts of things whether it is just sharing links to sites that can infect you with malware or sharing links to sites that,

Things like anywhere you have a website

JavaScript in there that will steal your passwords or you name it so this affects everyone and and to give you Somebody somebody wrote a a bot With AI, those things are starting to get much smarter.

For the well intentioned people They have shared CPU, high memory, block and object storage, backups,

These are these are the people who are coming into your site, And they're trying different things. They're they're plugging and playing in your API. They're hitting your site in all sorts of ways. They're trying to test your site in different types of ways. Let's talk a little bit about what kind of bad things can happen to your application first and foremost, and then let's talk about some of the solutions.

fill that form up or they could, spam your website cause your website to fall over. Someone could spam not as you intended, you could possibly have some downsides to that.

just a scope about how you know how This isn't just, you know,

that people can type in and, These rate limiting things will generally allow you to specify a good way to stop Someone could sign up with an email that isn't theirs.

or In general, sometimes those tokens will be tied to specific IP addresses or any other stuff we talked about as well. Totally word. There's CSRF. We have a whole show,

small little website mom and pop website here. I mean, Google has major issues with this even in in YouTube. I still

emails filled with stolen credit card data,

public facing Hosting providers out there that turn their eye, and they're the ones that host things like these course platforms that They have

or at least it can be depending on where you host. But these also might be reasons why,

And don't forget to subscribe in your podcast player

Wednesday.

It's generally good to put A lot of the especially rate limiting and captures in place. Yeah. Before you have trouble with that type of stuff, because it's not if somebody is going to do it. But when that type of things happen, and you don't wanna have to be scrambling, or use any of their other services, you're gonna wanna check out Linode@linode.

flag you as being a malicious actor because your users are being malicious on your site too. Right? You could get kicked off of any service that you're using

Peace. Peace.

having a a service for some of your back end stuff might be helpful because then you I got a lot of those services have rate limiting built in. That way it's not something you're having to deal with yourself, but

And You visit a website that takes a little bit of energy from your server to load that page. Okay. Now do it a 1000 times

it. Or anything like that. So you gotta definitely stay on top of these things. And and some of them, like the CloudFloor DDoSing protection, is super easy to implement.

yeah. Definitely stuff you need to be on or at least be cognizant of, This episode is sponsored by 2 amazing companies, which is Linode and Sentry. Wes, would you love it. To talk about Linode, and I would love to talk about Sentry. Would love to talk about Linode. Linode is

Head on over to syntax s.f m for a full archive of all of our shows.

Especially if people are interacting with your application in any sort of meaningful way that is submitting things to your database or Submitting things to a third party processor, payment processor, that type of thing. I just looked it up. Cloudflare does have Rate limiting. I I have never used it before,

a edge function or serverless function or or in my case, a middleware in front of it,

or drop a review if you like this show.

known ASNs, and you can just completely recapture it from Google is pretty good, because it will only pop up.

you can get go online and find lists of steal our courses and on a lot of hosted services. Cloudflare is probably the biggest one out there.

but that would be and and then what they can do is if you okay. Okay. Somebody is trying too many time, you can throw a per second. Alright. That's starting to get. Oh, it's that TikTok. Oh, that's a lot of slices.

Add that logic on top. Word. Cool. Well, this is how you can prevent bad actors from doing bad acting on your site. Wes, you got anything else before we kick this one off? Thanks for tuning in. Catch you on visually

when that type of thing happens. Yeah. You don't want and you don't want the services that you use to

That's also a really good use for edge functions. When we talked about that is that people can CD stuff to happen on it. Like if you try to you're trying to run a script people can only do something so many times before you say, alright, you've done it too much. So, you can rate limit someone by IP address.

there's only motorcycles on this. What am I supposed to do? You think these motorcycles are bikes? What do you do? What? Why am I trying to, You know, pick these things out for you, dumb computer. You know, the one I like the most is the one where you just drag the puzzle piece into the puzzle piece. Yeah. That's the one I like. Was using that.

allow that to have a and that will What privacy? so DigitalOcean, on Linode Generally, you'll also need a knots with that. Otherwise, someone could just hammer that API endpoint

Like, maybe we shouldn't When you load a form, let's say you have a form to sign up, And,

like, recaptcha is the worst of all of them in terms of user annoyance.

It. Like, how many times have you had a recapture that's like, select all

the the the, stoplights, and then you get a tiny little sliver of a spotlight stoplight or whatever. You're like, what? It. Select all the bicycles.

to detect how to do that in Puppeteer. There's a really good blog post on Medium on how to How they use machine learning to go pass it. So that one's been broken? Yeah. Well, like, that's the thing is that we love those ones because they're easy.

It's a Chinese company.

There's only there's only,

Yeah. Google's like, are you on a VPN on your IP? Flag your IP for something.

There is DDoS protection So that is stopping malicious actors. There's just a couple of things here and there you can do.

So there's always this, like, constant battle between privacy and, Linode is awesome. They have products for literally everything. Probably, what you, the listener, wanna use is You can spin up a little Linux server real quick. They have lots of images already that you can like, oh, I wanna use Node. Well, they've got a Node image. Just spin that sucker up, That's why if you like, if you go to Reddit and it says, like, 8 comments or even on Twitter, you said 3 replies and you click through to it. There's only 2.

Yeah. Yeah. That that can be really frustrating.

It. And websites don't necessarily love those ones because the easier they get for us, the, easier they also get for the robots. Yeah. And the thing I think you probably hit a lot more captures than I do because you are often on a VPN. Right? Yep. And every time you search for anything.

Again, that's that's an example of

students sign up for my course as part of the class, a cloud computing and Linux Servers are alternative to AWS.

to log out,

I specifically do that, on 100,000 websites. And it's a it's a numbers game. Definitely. Exactly.

and their resolver would just return the user object as if they were not logged

Takes Wes's videos, you $100 in a free credit to Linode, which is like, you the good people want privacy, but bad people also so that they can

feel like they are not logged in even though they are.

or it wouldn't let them relog in. It would just make them,

use cases. Yeah. One thing I do is is I I have, like, some function that's only for specific users who are logged in, And they would create fake accounts, and then they would have a logged in account and then hit the thing, you know, a 100 times.

and it got it bit me once,

screw around with the the people that is doing the most. Unfortunately, it's Almost not almost never, but it is often Someone can abuse a resource that will cause strain on your server. That's generally called the DDoS attack where

a process put in place to stop malicious people from doing things And you actually hit legitimate, tries and time. So it's the rate limiting is generally a mix of how many times can they try and what's the period that they can try within.

That that actually works pretty well, I think. Yeah. Oh, that's great. It's always nice when you can

I would I would have a class or a role on the user that would ban the user would be banned, Some of the other ones like rate limiting can be a little bit tougher because you kinda have to implement it yourself,

email addresses as quick as you can, and I got them up and running and they could do their class. But, And somebody once had their entire class of

bought Just a robot. Know how to do these things. It's not actually people. It's just someone that's written a bot And they're going to try these 10 things that are known to work So first one is rate limiting, put and you're like, your Node application to it.

it. So the user of the robot, the UI, would see that the user is not logged in, but they were given no ability to log out. There's no API method they they could access to log out. There's nothing that they could do

So instead of banning their IP,

it. Make the computer

it. Users, GitHub issues, all that and more. Check it out at century.i0.

Hey.

you name it, DDoS protection, DNS management, node balancers, virtual LAN.

Sick. This episode is also sponsored by Century. The perfect place to track all of the things that are going wrong on your site but also potentially make sure that some of your

Excited to talk about the bad guys today.

where you can get actual messages if, let's say, you fix The problem and it returned, you're gonna get an email saying there was a regression for that specific issue.

It. Talking about the bad guys.

We're gonna be talking about malicious actors and how we can stop them. I'm not talking about film actors. I'm talking about people using your stuff. So people who are using your stuff and who are up to no good, we're gonna be talking about how to stop them from doing their wrongdoing. So My name is Scott Tolinski. I'm a developer from Denver, Colorado. And with me as always is Wes Bos.

You can tie issues to specific releases, the the computer or user

Working or not?

Use the coupon code tasty treat, all lowercase, all one word, and you'll get 2 months for free. Thank you so much it. To both of our wonderful sponsors today who are not malicious actors. Wes, malicious actors.

manage databases, MySQL, like, I have a feel. I always wanted to know, like, Cloudflare. Like, They probably have just, like, this room of people who are, like, part of the CD underbelly Like, all the bad stuff that's going on because, Put rate limiting in an edge function instead of having that logic directly in your API code. You can just write your API code that like, it's wide open, host your website

things that you set in place here with our malicious actors there maybe potentially

If you want to, cause Okay. Now do that a 100,000 times a minute. That's a lot of slices, you know, and they tried to, like, play a game and they're like, you don't have any tickets.

Because what Sentry does is it gives you all kinds of logging information for your site about errors and exceptions in performance and more. This allows you to see exactly what's happening on your site really at any given time in a way that makes it so that you can fix things before they are a big, big problem. In In fact, anytime that I do releases, which, of course, I I gotta do releases. Everybody's releasing stuff. I gotta release stuff. Anytime you do releases of new code, it's always important that you know it. That your code is as bug free as possible

Amazing. That's a really good deal. Thank you, Linode, for sponsoring.

And you can right away deploy are kind of similar to nonce. They're they're tokens that Are that must be sent along with the request.

they and we can't get access to it.

whoever posted a reply You can use this

It's likely because and then throw a whole lot of special sauce that, Cause you resources or undue stress or any of these things. So, post a comment or review or or literally anything, it. They can,

malicious. Totally. Next, we have tokens.

These are called nonce.

On this Monday, hasty treat.

Open wide dev fans, get ready to stuff your face with JavaScript, CSS, node modules, barbecue tips, get workflows, breakdancing, soft skill, web development, the hastiest,

the tastiest web development treats coming again hot. Here is Wes, Barracuda,

Monday. Monday. Monday.

Boss, and Scott

the craziest,

CSD. Welcome to Syntax.

Yeah. Cloud file use it. HCaptcha. It works fine. It works very well. So yeah. It hCaptcha is nice because in front of them and be like, alright. You're trying to do something, or you can block them entirely.

The the thing about using recapture is you're literally letting Google you set a cookie, and they can only do it so many times. That's Also easy to get around. That's how, newspaper websites generally do it. You you reached your free articles,

hosts that will allow

the last 1 is, and they're like, hey. Our teacher is trying to like, today's course is take Wes'

your Comcast, Linode, Cloudflare, 100

do DDoS attacks and whatever. And as long as the bills getting paid, they don't they don't necessarily care.

you can ban specific ASNs.

bad like, let alone us trying to protect our little video websites. Right? Like, what kind of stuff do they see of Yeah. Right. Yeah. Totally. The world's banks and stuff. And then

AT and T, every single ISP out there will have an ASN.

And there are a lot of known Because I think I say, like, you can only try do these things 10 times every 15 minutes or something like that.

of the Internet, and they know, So an ASN number, What does ASN mean? Alberta student number. No. Yeah. I don't know what ASN means. Autonomous system number. So every time there is an ISP, H k. That's from Cloudflare. Right? Or is that just a open source one? See, I'm gonna Google it right now. It's not. We've we've done this before. I told you. We've done this for Cloudflare. It's not.

for the day.

that are not necessarily, please, please let this be it, you know? Yeah.

If you delete your cookie Yeah. Yeah. I like that one. What is that called? I I tweeted about it a couple months ago, and someone said what it what it was.

or open up a new browser or incognito mode or they have a number, Other ways you can get around this silly question asking what is 2 plus 4? I know my kids Specifically, I have this on iPad apps. This is not to stop malicious actors, but it's a great way to S com forward slash syntax. It's gonna get you is shadow banned, but the person but from their end, everything everything looks like it worked properly. Their Reddit comment is showing up. Their YouTube comment is showing up. But in reality, the rest of the world can't see it, and that's Very frustrating to somebody who's trying to be So whether they are hosting provider or Internet provider, Otherwise, That will Allowances between those websites, but you wanna make sure that people aren't And there's always a little bit of give and take. The probably the most straightforward one is that we sometimes have to select boats CS or stoplights from a CAPTCHA, So, someone's trying to share passwords, and It's not working, so I was like, oh, shoot. Like like, that's a legitimate. There's a school, has a single IP address, and they need to sign up 100 times in a minute. So I had to manually process those. I said, hey, give me a list of directly without even being in the browser. But, generally, what a nonce will do is you load the page, it will give you a token, and it says, alright. Here's a token.

most people, ban them from visiting your website entirely. So that is another trick that a lot of people do.

anything. You can you generally get around that as well. But, So it's not like you can try 10 times and then that's it. And it's not like you can only try once every 15 minutes. You can say, alright. Well, you got It's like a password, you know? You're like, you're trying to type in a password and you get it wrong 4 times And what that means is that It was hilarious. 1 of the students sent me a DM on Twitter,

or they can't tell.

pop it in.

make sure that the ad is actually a human from going Going forward, so you can simply ask, like, which one of these animals barks?

Yes. I it. Want to get banned. I don't wanna have to call the phone number to get on there. Exactly. Whatever they ask you to do. That's another beautiful thing about password managers that never happens anymore. You just have to But, again, most cases, these people don't have AI. Yep. The shadow ban is kind of what I did, where you're banning a user And almost they don't necessarily know that they're banned. Right? That's that's what I think of as a shadow ban. It's like, basically, you're you're removing their features. But To them, they don't see that as their features are removed necessarily,

You know, Reddit Reddit does a lot of, like, shadow banning or banning, I think, really well.

CAPTCHA. We all know CAPTCHA is. Yeah. Yeah. CAPTCHA as you type in the thing. There's a whole bunch of other ones. The invisible in on every single page of every single website.

Yeah. Totally.

go to back. Listen to the whole show on CSRF. It's basically to stop people when you're logged in from 1 website

and pinging it from another website when there are course 10000 emails.

the world is broken,

doing malicious things? Well, without having to hurt

and, there are people that will abuse that. Right? So you have to There's, like, a fine balance between annoying your good users and stopping the bad people from from doing things.

You're proper users.