Possible for powerpage attack on number of anonymous users?

(0) Share

Report

Posted on by Community Power Pla... Microsoft Employee

So according to this page https://learn.microsoft.com/en-us/power-platform/admin/powerapps-flow-licensing-faq#power-pages, the anonymous users are counted via cookies with certain restrictions regarding when the users are counted (bots aren't counted etc)

However I'm worried that it might be possible for a malicious agent to create a simple RPA or something along those lines designed to quickly cycle through opening the website and then clearing the browser's cookies to exhaust the number of anonymous logins.

Can someone redirect me to information on how this is avoided? I won't be able to deploy a Power Page if there is a chance that a simple attack might make us have to pay way more for user addons.

Categories:

General topics

All responses (5)

Answers (0)

Sort by

oliver.rodrigues 9,482 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Hi, may I ask if this is a real-scenario concern? I feel like the probability of this is very low, if someone will try to create a malicious agent or something, they will try to hack into your data/systems and do a big damage. I don't feel like they would be trying to make you spend more money with licenses.

But answering to your questions, all Microsoft says is that they will identify bots/crawlers to not count them as part of your licensing capacity, I haven't seen details as to how this identification will happen.

If this is a big concern for your project, I think you might need to raise a support ticket to see if they can give you more details.
Community Power Pla... Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

It is not a realistic concern I'd say, but it is big enough that IT might block my project from progressing.
PVaartstra 4 on at

Like
a
(0)

Report
Copy link

Link copied!

I like to evaluate risks in terms of probability and impact. In this case:
Probability: low
Impact: High ($$$)
premie21 8 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi, by any chance did you get any solution to your problem?
Suggested answer

ragavanrajan 7,044 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Hi There,

There is a simple way to prevent this.

Step 1: You need to enable CAPTCHA

Also, Recently In Power Pages you can enable WAF to prevent any malicious attacks

This will prevent cross site scripting, protocol attackers and many more.

Adding official refernce:

https://learn.microsoft.com/en-us/power-pages/security/web-application-firewall?WT.mc_id=DX-MVP-5004934

Hope it helps.
------------

If you like this post, give it a Thumbs up. Where it solved your request, Mark it as a Solution to enable other users to find it.