4 ms·
Can you give an example? I asume spam bot should run in a browser-like enviroment (i.e puppeteer), which events should behave the same (i.e `isTrusted` will al
by docuru 6y ago
Can you give an example?
I asume spam bot should run in a browser-like enviroment (i.e puppeteer), which events should behave the same (i.e `isTrusted` will always be `false` since events are not real).
- trinovantes 6y agoA malicious bot developer can just compile their own browser and set the flag to be true
- docuru 6y agoAlright. I forgot that people can roll their own browser. Update: I did a little research, but still unsure if it is possible to modify `isTrusted` from the core (Chromium, Qt).
- phillipseamore 6y agoHow are you guarding you endpoints? Most bots just scrape and parse HTML/JS looking for form actions, fields, fetches and XHRs and send straight to the endpoints. No browser engines involved.
- docuru 6y agoFor the APIs, that'd be rate limiting and blacklist IPs. It doesn't completely stop spam, but would reduce them. Is there any other method should I be thinking about?
- phillipseamore 6y agoI've used all kinds of things through the years; CAPTCHAs, expiring tokens, signed endpoint URLs. For local websites I've also simply blocked IP ranges from various countries (sometimes even down to all other states/countries). All your focus should be on doing validation at the endpoint, doing stuff on the client side (not related to validation at the endpoint) is a waste of time.
- docuru 6y agoHmm, true. Thanks for the useful insights