Hi,

I had antibot running on form. It is not generating unique key after every submission. With current static key on form id basis bots are bypassing antibot and submitting the spam messages.

If we able to generate new key for every submission i think we can resolve this issue

Thanks
Rakesh

Comments

rkamepalli created an issue. See original summary.

mstef’s picture

mstef commented

Unfortunately, no way to really do that without disabling caching on pages with forms, and that goes against one of the main points of this module. Are you really sure that bots are specifically injecting the keys in order to get past antibot? If that is true, you need to find out if they are hard-coding them or actually pulling them from the Drupal JS settings.

rkamepalli’s picture

rkamepalli commented

Thanks for the quick reply.

  • Consider if spammer hardcoded the unique generated key for the form one time, then bot can able to do unlimited spam submissions
  • If we do something like this while generating the key
    $key = Crypt::hmacBase64(uniqid($form['#form_id']), Settings::getHashSalt()); would that help. Just a thought

Thanks
Rakesh

mstef’s picture

mstef commented

That's exactly what is already being done:

$key = Crypt::hmacBase64($form['#form_id'], Settings::getHashSalt());

This means a bot would either have had hard-coded your site's unique keys for each form, or there are bots out there designed for antibot and they are reading the keys in the JS settings; either is possible. And for either of these, these bots must have JS enabled and are triggering mouse or keyboard actions. That would be quite sophisticated for an anti-spam measure only installed on about 27K sites. It is possible though.

I'm very open to any other ideas to increase the randomness of the keys as long as it doesn't interfere with page caching.

gaurav.kapoor’s picture

gaurav.kapoor commented
Status: Active » Closed (outdated)