How to implement Stack Overflow's "are you a human" feature?

Question

On this site if you do too many clicks or post comments too fast or something like that you get redirected to the "are you a human" screen. Does anybody know how to do something similar?

Answer 1

just check how many hit / minutes you get from a specific ip or session or whatever and decide what are your preferred threshold and your good to go

Answer 2

http://recaptcha.net/

Answer 3

At a guess...

Write a HTTP handler that records requests and store them in session.

When a new request comes in, check to see how many requests are stored (and expire old ones).

If the amount of requests in the past few minutes exceeds a given threshold, redirect the user.

If you're doing this in ASP.NET webforms, you could do this check on the site master page, ( or write a IHttpHandler).

If you're using an MVC framework, you could write a base controller that does this check for every action.

With rails, you could write a before_request filter.

With asp.net MVC, you could write a [ActionFilterAttribute] attribute

Answer 4

I'd also check the user agent header of the request - if it doesn't look like a popular browser (or is empty) then throw the "are you a human?" page.

Answer 5

It's almost certainly a heuristic that tries to "guess" that a user is some form of automated process, rather than a person, for example:

• More than "x" requests to do the same thing in a row
• More than "x" actions in a "y" period of time

Ordinarily the "x" and "y" values would be formulated to be ones that it would be unlikely for a "real person" to do, like:

• Editing the same answer 5 times in a row
• Downvoting 10 questions within 1 minute

Once you've got your set of rules, you can then implement some code that checks them at the start of each request, be it in a method that's called in Page_Load, something in your masterpage, something in the asp.net pipeline, that's the easy bit! ;)

Answer 6

You should have a session to track the user activity.

In session you can have counter for commenting and posting like:

(pseudo code instead of C#, sorry :)

if (post_event) {

    posts_during_1_minute_interval++;

    if (time_now-reference_time > 1_minute) {
    reference_time = time_now;
    posts_during_1_minute_interval=0;
    }
}
...
if (posts_during_1_minute_interval > 10) redirect("/are-you-human.htm");

where on are-you-human.htm page you can have recaptcha, as they have here on StcakOverflow.com

see also:http://blog.stackoverflow.com/2009/07/are-you-a-human-being/

Answer 7

Here is a very nice Captcha Control for asp.net that first of all you need

http://www.codeproject.com/KB/custom-controls/CaptchaControl.aspx

Then you can use it together with this idea that try to find the dos attacks

http://weblogs.asp.net/omarzabir/archive/2007/10/16/prevent-denial-of-service-dos-attacks-in-your-web-application.aspx

be ware of a bug in this code in line if( context.Request.Browser.Crawler ) return false;, its must return true, or totally remove it for sure.

and make it your compination for the clicks, or submits.

If a user make too many clicks on a period of time, or many submits, then you simple open the capthaControl, and if the clicks are by far too many, then triger the dos attact. This way you have 2 solution in one, Dos attact prevent, with captcha at the same time.

I have made somthing similar my self, but I have change the source code of both, a lot to feet my needs.

One more interesting link for a different code for the dos attack.

http://madskristensen.net/post/Block-DoS-attacks-easily-in-ASPNET.aspx

Hope this help you.