Django无认证POST API安全防护咨询：安卓APP接口防滥用方法

Great question—unauthenticated public APIs like signup, login, and token registration are top targets for bots, brute-force attacks, and spam. Here’s how to harden them using Django tools and practical best practices:

1. Add CAPTCHA Verification #

CAPTCHAs are your first line of defense against automated bots. For Django, the django-recaptcha package makes this straightforward:

• Use reCAPTCHA v3 (invisible, non-intrusive) for a smooth user experience—it scores requests and blocks suspicious ones without requiring user interaction.
• For higher security, opt for reCAPTCHA v2 (the "I’m not a robot" checkbox) for signup/login flows where you want explicit human confirmation.

Example implementation in a signup form:

from django import forms
from captcha.fields import ReCaptchaField
from captcha.widgets import ReCaptchaV2Checkbox

class SignupForm(forms.Form):
    email = forms.EmailField()
    password = forms.CharField(widget=forms.PasswordInput())
    captcha = ReCaptchaField(widget=ReCaptchaV2Checkbox)

In your view, validate the form as usual—if the CAPTCHA fails, the form will return an error and block the request.

2. Enforce Rate Limiting #

Limit how many times a single IP (or user identifier) can hit your endpoints in a set window. The django-ratelimit package is perfect for this:

Example rate-limiting a signup view:

from ratelimit.decorators import ratelimit

@ratelimit(key='ip', rate='5/m', method='POST', block=True)
def signup_view(request):
    # Your signup logic here

This restricts each IP to 5 signup requests per minute. For login endpoints, you can tighten this further (e.g., 3 attempts per minute) and temporarily lock IPs after multiple failed attempts to block brute-force attacks.

3. Implement Email/Phone Verification #

Even if bots get past CAPTCHAs, requiring account activation via email or phone ensures only real users can actually use your app:

• Use django-allauth for out-of-the-box email verification flows, or roll your own:
  1. After signup, generate a unique activation token and send it to the user’s email/phone.
  2. Only mark the account as active once the user clicks the verification link or enters the code.

This stops fake accounts from being usable, even if they’re created by bots.

4. Strict Input Validation & Sanitization #

Don’t skip basic validation—malicious actors will try to inject junk or exploit weak inputs:

• Use Django’s ModelSerializer or Form classes to enforce strict rules:
  • Password strength (minimum length, mix of letters/numbers/symbols)
  • Valid email/phone formats
  • Reject overly long or suspicious input values

Example password validation in a serializer:

from rest_framework import serializers

class SignupSerializer(serializers.Serializer):
    email = serializers.EmailField()
    password = serializers.CharField(min_length=8)

    def validate_password(self, value):
        if not any(char.isdigit() for char in value):
            raise serializers.ValidationError("Password must contain at least one number.")
        if not any(char.isupper() for char in value):
            raise serializers.ValidationError("Password must contain at least one uppercase letter.")
        return value

5. IP Blacklisting (and Whitelisting, if applicable) #

Track malicious IPs that repeatedly violate your rate limits or submit spam, and block them at the Django level or via your web server:

• Use django-ipware to reliably get the user’s real IP address (accounting for proxies like Cloudflare).
• Create a middleware that checks incoming requests against a blacklist of IPs stored in your database, and returns a 403 Forbidden if a match is found.

6. Use a Web Application Firewall (WAF) #

Add a WAF like Cloudflare or AWS WAF in front of your Django app to filter out malicious traffic before it even reaches your API. WAFs can block:

• SQL injection attempts
• XSS attacks
• Known bot IP ranges
• Request patterns associated with brute-force attacks

This is a great complement to your Django-level protections.

7. Obscure Endpoint Paths (Minor but Helpful) #

Avoid using obvious paths like /api/signup or /api/login. Instead, use less predictable routes like /api/v1/account/register or /api/v1/auth/access. While this won’t stop determined attackers, it adds a small layer of obscurity to reduce automated scanning.

Combine these strategies for the best results: for example, rate limiting + CAPTCHA + email verification will block nearly all automated abuse while keeping the flow smooth for legitimate users.

内容的提问来源于stack exchange，提问作者Santhosh