user subscription and authenticity_token need CAPTCHA ?

Question

I am currently developing a user subscription module and I would like to know if I need to use captcha in rails 3 because authenticity_token sound good.

Thanks

Answer 1

Depends on what kind of security you want in this app. What are you trying to prevent?

authenticity_token will just protect you from cross-site request forgery. If you are trying to prevent bots from signing up you will need to use captcha. Someone can easily write a script to mimic a browser session which will make use of the authenticity tokens and be able sign up.