4 ms·
That's also relatively easy to protect. First defense is rate-limited, second is captchas, third is having a dynamic "secret" key fetching from some backend via
by capableweb 4y ago
That's also relatively easy to protect. First defense is rate-limited, second is captchas, third is having a dynamic "secret" key fetching from some backend via JS that gets injected into the form and works as a "password" to successfully trigger the email to get sent (but displaying success messages even if it's not).
- d110af5ccf 4y ago> but displaying success messages even if it's not Please don't do stuff like this. Some of use use VPNs and aggressively block third party JS. These sorts of shenanigans render many sites unusable which is frustrating but simply not using those services is a price I'm more than willing to pay at this point.
- capableweb 4y agoThere is no need for 3rd party JS. It's something like ten lines and you can embed it in a script tag right next to the form elements.
- parasti 4y ago> dynamic "secret" key fetching from some backend via JS that gets injected into the form and works as a "password" to successfully trigger the email to get sent Are you describing nonces? A nonce is basically a "secret" (due to SSL encryption) number inserted into the HTML and submitted via a form. You don't need JS, just SSL.
- capableweb 4y agoYeah, but in simpler terms :) Making it require JS is on purpose as a lot of spam robots only parse HTML and don't execute JS, so you get less spam that way.