Prevent Form spam with the session

Question

Hello,

I've already read most of the questions regarding techniques to prevent form spam, but none of them seem to suggest the use of the browser's session.

We have a form that sends an email to given email address and we didn't like the idea of using "captchas" or Javascript, as we wanted to keep the user journey simple and accessible to those without Javascript.

We would like to use the session object to help prevent form spam. Our webapp is developed on Weblogic Server 10 using Struts.

The solution being, when the form loads, it would set a variable in the session object. Once you click submit, we check if the session for the variable. No variable, redirect to the form. Variable exists send the email.

I would really appreciate any opinions/reasons why this might be a bad idea, so we can evaluate this solution against others.

Many thanks, Jonathan

Answer 1

Session objects can, depending on implementation, be relatively heavy in terms of resource usage, as well as somewhat slow. Additionally, the spammer, if they realize how you are blocking them, can simply start a new session every time they hit the form by not sending back the session cookie.

So, because that technique relies on the client to behave nicely, and the expected behavior is fairly easy to prevent, it is possibly less useful than some other ways to solve the problem.

Answer 2

Thank you for your reply cdeszaq, but I'm not sure if you mis-understood my question.

For the form submission to complete successfully, clients will be forced to load the form to set up the session object correctly. Only when the session is in the correct state, will it be possible to send an email.

If the spammer is not sending back the session cookie, then they will not be able to spam my form as they haven't gone to my form page that creates the right session.

I agree that using the session object would create extra resource. Our implementation would simply, (using JSP) call session.setAttribute("formLoaded", true); and in my Struts action I would simply use session.getAttribute("formLoaded"); to check.

Answer 3

There is nothing to prevent a spammer from automating the process of downloading your form (thus generating the cookie) and submitting it. It may impose a slight burden on the spammer, but a trivial one.

As an example, a form can be easily downloaded and submitted, with cookies preserved, using a command-line tool such as cURL. This can then be run from a script repeatedly.

Answer 4

I wonder if this might work:

1. Each time you render page/form, create a random bit of text
2. Put that text in the session
3. Include that text as a hidden field in the form
4. User submits the form
5. Action compares the hidden text to the value in the session - if there's a match, send the email

Since a hacker wouldn't be able to put any random value in the session, they wouldn't be able to spam. Right?