Guest vs member access during floods, and why cookies are now required

[exxos]

Why guests and members are treated differently here now (and why it might be worth registering)

This one is a bit technical, so I will try to keep it simple.

For months I have been trying to tell a real visitor apart from a bot hitting the forum. I have tried a lot of things, and some of them still hold up today. The trouble is "today" is doing a lot of work in that sentence. Whatever works now is not guaranteed to work next week, and I cannot sit watching server logs every hour of every day to find out when it stops.

After all that, I have come to a fairly blunt conclusion: there is no reliable, lasting way to separate genuine guest readers from bad traffic pretending to be one. I have stopped trying. It is a fight that cannot actually be won, only delayed a few days or weeks at a time, and every hour spent on it is an hour not spent on anything else.

So the approach has changed. Instead of sorting good guest traffic from bad, the site now works on a simpler rule: treat all traffic as untrusted unless there is a good reason to think otherwise. The one reasonably solid signal available for that is whether someone is logged in as a genuine member.

In practice this means guests and members now sit on separate pools of server resources. If the forum comes under heavy load or a flood of bad traffic, it is the guest pool that takes the strain first. If that pool gets exhausted, guest access can be lost until things settle down. Members sit on a separate, better protected pool and are far less likely to be affected.

phpBB's own login cookie was never built for this. It can be spoofed, and I am not willing to rely on it as proof someone is who they say they are. So there is now a second cookie behind it, encrypted and much harder to fake. As mentioned in the server updates thread a few weeks back, this also means cookies are now required to log in. No cookies, no login. I know that will not suit everyone, but it buys something a lot more solid.

If you read as a guest and want your access to hold up when things get rough, the simple answer is to register. It costs nothing and takes a minute.

This is one part of a longer job. I am having to write a fair number of extensions to change how phpBB handles requests, and in places rewrite chunks of it outright, to get this to hold up properly. That will likely carry on for some weeks yet, so expect more posts like this one.

Thanks for reading this far. Setting up a modem in 1989 was a simpler affair than any of this.

[rubber_jonnie]

All seems very sensible to me.