Authenticating a site while protecting against security holes by handling common web server configurations
Techniques are provided through which a user is verified as authorized to modify a website. A web crawler generates a filename and content for the user, who purports to be authorized to modify a particular website. The web crawler sends the filename and content toward the user. The user stores a file with the filename on a server that hosts the website. The user places the content within the file. The web crawler determines whether the file is stored on the server and whether the content is in the file. If so, then the web crawler stores information that indicates that the user is authorized to receive information pertaining to the website, which may be confidential information. If the file is not stored on the server or if the file does not contain the content, then the web crawler does not provide any information to the user pertaining to the website.
1. A method for authenticating a user that requests information pertaining to a website, the method comprising the steps of:
an entity associated with a web crawler generating a filename and content for the user that is purportedly authorized to modify the website;
the entity sending the filename and the content toward the user without sending said information pertaining to the website toward the user, wherein a file with the filename and the content are not stored on a server that hosts the website when the filename and the content are sent toward the user;
wherein, after the filename and content are sent toward the user, the user creates a file with the filename, causes the file to be stored on a server that hosts the website, and causes the content to be stored in the file;
after sending the filename and content toward the user:
determining whether a file with the filename is stored on a server that hosts the website;
determining whether the file contains the content; and
in response to determining that the file is stored on the server and the file contains the content, the entity storing data that indicates that the user is authorized to receive said information pertaining to the website;
wherein said information pertaining to the website is sent toward the user only after it is determined that the file is stored on the server and the file contains the content;
wherein the steps of generating, sending, and storing are performed on one or more computing devices.
2. The method of claim 1 , wherein the information was generated by an entity that sent the filename and the content toward the user.
3. The method of claim 1 , wherein the steps further comprise before generating the filename and content for the user, receiving login information from the user, wherein the user indicates that the user is purportedly authorized to modify the website.
4. The method of claim 1 , wherein the steps further comprise before determining whether the file with the filename is stored on the server that hosts the website, receiving notification data from the user indicating that the file and content are on the website.
5. The method of claim 1 , wherein the steps further comprise in response to determining a) that the file with the filename is stored on the server that hosts the website, and b) that the file contains the content, associating the user with the website.
6. The method of claim 1 , wherein the step of storing data that indicates that the user is authorized to receive information pertaining to the website includes providing said information to the user.
7. The method of claim 1 , wherein the server is configured to return a soft 404 error message when an entity that generated the filename and content attempts to determine whether a particular file is stored on the server and the particular file is not stored on the server.
8. The method of claim 1 , wherein sending the filename and content toward a user includes instructing the user to store the file with the filename on the server and to store the content in the file.
9. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 8 .
10. A method for authenticating a user that requests information pertaining to a website, the method comprising the steps of:
receiving login information from the user, wherein the user indicates that the user is purportedly authorized to modify the website;
in response to receiving the login information, generating a filename and content for the user and sending the filename and the content toward the user without sending said information pertaining to the website toward the user, wherein a file with the filename and the content are not stored on a server that hosts the website when the filename and the content are sent toward the user;
wherein, after the filename and content are sent toward the user, the user creates a file with the filename, causes the file to be stored on a server that hosts the website, and causes the content to be stored in the file;
after sending the filename and content toward the user, receiving notification data from the user indicating that a file with the filename and the content are stored on a server that hosts the website;
in response to receiving the notification data:
determining whether a file with the filename is stored on the server that hosts the website; and
determining whether the file contains the content; and
only after determining that the file is stored on the server and that the file contains the content,
associating the user with the website, and
storing data that indicates that the user is authorized to receive said information pertaining to the website;
wherein said information pertaining to the website is sent toward the user only after it is determined that the file is stored on the server and the file contains the content;
wherein the steps of receiving login information, generating, sending, and storing are performed on one or more computing devices.
11. The method of claim 1 , wherein the information pertaining to the website includes at least one of an identification of one or more origins of web traffic to the website or an identification of one or more other websites that link to the website.
12. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 1 .
13. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 3 .
14. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 3 .
15. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 4 .
16. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 5 .
17. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 6 .
18. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 7 .
19. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 10 .
20. A machine-readable storage medium storing instructions which, when executed by one or more processors, cause performance of the steps of claim 11 .
21. The method of claim 1 , wherein said information pertaining to said website includes at least one of the following: references to where web traffic to said website originates, references to a plurality of websites that contain a link to said website, or one or more errors of said website.
22. A machine-readable storage medium storing instructions which, when executed by one more processors, cause performance of the steps of claim 21 .