1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
|
class CrossOriginMonitor {
constructor() {
this.requestLog = [];
this.suspiciousRequests = [];
this.rateLimiter = new Map();
}
logCrossOriginRequest(req, res, next) {
const origin = req.headers.origin;
const userAgent = req.headers['user-agent'];
const ip = req.ip || req.connection.remoteAddress;
const logEntry = {
timestamp: new Date().toISOString(),
origin,
method: req.method,
url: req.url,
userAgent,
ip,
headers: req.headers
};
this.requestLog.push(logEntry);
this.detectSuspiciousActivity(logEntry);
if (this.checkRateLimit(ip, origin)) {
res.status(429).json({ error: 'Too many requests' });
return;
}
next();
}
detectSuspiciousActivity(logEntry) {
const { origin, ip, userAgent } = logEntry;
if (origin && !this.isKnownOrigin(origin)) {
this.suspiciousRequests.push({
...logEntry,
reason: 'Unknown origin',
severity: 'medium'
});
}
if (this.isAbnormalUserAgent(userAgent)) {
this.suspiciousRequests.push({
...logEntry,
reason: 'Abnormal user agent',
severity: 'low'
});
}
if (this.isHighFrequencyRequest(ip)) {
this.suspiciousRequests.push({
...logEntry,
reason: 'High frequency requests',
severity: 'high'
});
}
}
isKnownOrigin(origin) {
const knownOrigins = [
'https://trusted-domain.com',
'https://partner-domain.com',
/^https:\/\/.*\.trusted-domain\.com$/
];
return knownOrigins.some(known => {
if (typeof known === 'string') {
return known === origin;
} else if (known instanceof RegExp) {
return known.test(origin);
}
return false;
});
}
isAbnormalUserAgent(userAgent) {
const suspiciousPatterns = [
/bot/i,
/crawler/i,
/spider/i,
/curl/i,
/wget/i
];
return suspiciousPatterns.some(pattern => pattern.test(userAgent));
}
checkRateLimit(ip, origin) {
const key = `${ip}:${origin}`;
const now = Date.now();
const windowMs = 60000;
const maxRequests = 100;
if (!this.rateLimiter.has(key)) {
this.rateLimiter.set(key, { count: 1, resetTime: now + windowMs });
return false;
}
const limiter = this.rateLimiter.get(key);
if (now > limiter.resetTime) {
limiter.count = 1;
limiter.resetTime = now + windowMs;
return false;
}
limiter.count++;
return limiter.count > maxRequests;
}
isHighFrequencyRequest(ip) {
const recentRequests = this.requestLog.filter(log => {
const timeDiff = Date.now() - new Date(log.timestamp).getTime();
return log.ip === ip && timeDiff < 60000;
});
return recentRequests.length > 50;
}
generateSecurityReport() {
const now = new Date();
const last24Hours = new Date(now.getTime() - 24 * 60 * 60 * 1000);
const recentRequests = this.requestLog.filter(log =>
new Date(log.timestamp) > last24Hours
);
const recentSuspicious = this.suspiciousRequests.filter(log =>
new Date(log.timestamp) > last24Hours
);
return {
period: '24 hours',
totalRequests: recentRequests.length,
suspiciousRequests: recentSuspicious.length,
topOrigins: this.getTopOrigins(recentRequests),
suspiciousActivities: recentSuspicious,
recommendations: this.generateRecommendations(recentSuspicious)
};
}
getTopOrigins(requests) {
const originCounts = {};
requests.forEach(req => {
if (req.origin) {
originCounts[req.origin] = (originCounts[req.origin] || 0) + 1;
}
});
return Object.entries(originCounts)
.sort(([,a], [,b]) => b - a)
.slice(0, 10)
.map(([origin, count]) => ({ origin, count }));
}
generateRecommendations(suspiciousRequests) {
const recommendations = [];
const unknownOrigins = suspiciousRequests.filter(req =>
req.reason === 'Unknown origin'
);
if (unknownOrigins.length > 0) {
recommendations.push({
type: 'security',
message: `发现 ${unknownOrigins.length} 个未知来源的请求，建议审查Origin白名单`,
priority: 'medium'
});
}
const highFrequencyRequests = suspiciousRequests.filter(req =>
req.reason === 'High frequency requests'
);
if (highFrequencyRequests.length > 0) {
recommendations.push({
type: 'performance',
message: `发现 ${highFrequencyRequests.length} 个高频请求，建议加强速率限制`,
priority: 'high'
});
}
return recommendations;
}
}
const monitor = new CrossOriginMonitor();
app.use(monitor.logCrossOriginRequest.bind(monitor));
setInterval(() => {
const report = monitor.generateSecurityReport();
console.log('Security Report:', JSON.stringify(report, null, 2));
}, 24 * 60 * 60 * 1000);
|
微信
