4 ms·
It's not just one example, you can 'hurt' a website simply by making a huge list of links with arbritrary query string garbage so that google picks it up, eg:
by zepolen 18y ago
It's not just one example, you can 'hurt' a website simply by making a huge list of links with arbritrary query string garbage so that google picks it up, eg:
http://domain.com/?dupcontent http://domain.com/?dupcontent
http://domain.com/?blabla http://domain.com/?blabla
What an app should really do is validate the arguments in the query string, remove any invalid ones, then issue a 301 redirect to the proper url.
For example:
http://www.google.com/search?q=someterm&unknown_variable=nothing http://www.google.com/search?q=someterm&unknown_variable...
redirects to
http://www.google.com/search?q=someterm http://www.google.com/search?q=someterm
Of course that's like getting everyone's CSS to validate correctly :)
Edit: It is also why I prefer to sort my query string so that it can be deterministic and always be the same no matter what order the args are in.
- briansmith 18y agoThat kind of attack won't work on a website that does a 301 redirect from all non-canonical URLs to the canonical ones.