3 ms·

If you don't want to require users to run javascript you should be able to make the server generate the timestamp.

by robalni 4y ago

mariusor 4y ago
How do you do that, without bots being able to circumvent the feature?
- sschueller 4y ago
  You could generate a CSRF token or something similar in a hidden filed based on a JWT token (yes I know) on the server side. The JWT token can either contain some timestamp after which it's valid or the time it was created.
- robalni 4y ago
  People will be able to write programs that circumvent the feature but that's also true for the javascript solution. The point of it was that it gets rid of most spam because most bots fill in the form faster than 4 seconds and are not made to circumvent this feature.
- Aachen 4y ago
  Bots can also circumvent this JS thing, so it's the same either way. <?php echo '<input type=hidden name=starttime value='.time().'>'; On submit: <?php if (time() - $_POST['starttime'] < 4) die('2fast4me'); Revealing the error condition (that it was submitted too fast) is nice for users and bots alike, of course. Up to you. I've had websites where I was too fast in submitting a form before. Not any kind of anti-spam, just their server was so fricking slow that I had input the date (iirc it was a reservation system) and clicked next before the JS blobs had finished triggering each other and fully loaded. It would break the page somehow with no visual indication. I found out by looking in the dev console and noticing stuff was still loading in the background. How normal people are able to use the Internet with how often I need the dev console to do entirely ordinary things is a mystery to me.
JimWestergren 4y ago
I used to do it with PHP but the problem is that then you can't cache the HTML (varnish or other solutions). Javascript don't have that problem and the added benefit of stopping bots that don't run javascript. In the error message I have a friendly texts for human to turn on javascript if it is off and a <a href="javascript: history.go(-1);">Go back and try again</a> making them not loose the text that they have typed.

If you don't want to require users to run javascript you should be able to make the server generate the timestamp.

mariusor 4y ago

How do you do that, without bots being able to circumvent the feature?

sschueller 4y ago
You could generate a CSRF token or something similar in a hidden filed based on a JWT token (yes I know) on the server side. The JWT token can either contain some timestamp after which it's valid or the time it was created.
robalni 4y ago
People will be able to write programs that circumvent the feature but that's also true for the javascript solution. The point of it was that it gets rid of most spam because most bots fill in the form faster than 4 seconds and are not made to circumvent this feature.
Aachen 4y ago
Bots can also circumvent this JS thing, so it's the same either way. <?php echo '<input type=hidden name=starttime value='.time().'>'; On submit: <?php if (time() - $_POST['starttime'] < 4) die('2fast4me'); Revealing the error condition (that it was submitted too fast) is nice for users and bots alike, of course. Up to you. I've had websites where I was too fast in submitting a form before. Not any kind of anti-spam, just their server was so fricking slow that I had input the date (iirc it was a reservation system) and clicked next before the JS blobs had finished triggering each other and fully loaded. It would break the page somehow with no visual indication. I found out by looking in the dev console and noticing stuff was still loading in the background. How normal people are able to use the Internet with how often I need the dev console to do entirely ordinary things is a mystery to me.

JimWestergren 4y ago

I used to do it with PHP but the problem is that then you can't cache the HTML (varnish or other solutions). Javascript don't have that problem and the added benefit of stopping bots that don't run javascript. In the error message I have a friendly texts for human to turn on javascript if it is off and a <a href="javascript: history.go(-1);">Go back and try again</a> making them not loose the text that they have typed.