tags:

views:

52

answers:

2

I understand the idea of generating a form token and storing it in a session, and also putting it as a hidden input in my forms.

But how could I make this work if I have pages with multiple forms, is it still safe to use the same token for each form?

And I still feel weary about bots and stuff on my website, can these form tokens really safely replace CAPTCHAs?

A: 

Nope, these tokens cannot replace captchas because these things serve different purposes.

From your confusion with tokens and captchas I suppose that you don't really understand these tokens. Are you sure you need separate tokens for every form? May be one token per session would be enough?

Col. Shrapnel
All I want to do is stop a BOT auto-submitting a form once every minute.
Juddling
@Juddling well tokens won't help you. Good CAPTCHA would.
Col. Shrapnel
A: 

It's absolutely fine to use the same token for all forms. Even on different pages. It's OK to generate the token in the very beginning of your users session and stick with it. Also those tokens only protect you/your users from Cross-site request forgery.

For protection from bots you still need Captchas or something equal.

Wolax