get GNU

Laravel Spam Protection

In routes.php, the routes look like this:

Route::get('register', function()
{
return view('app');
});
Route::post('register','HomeController@store');

And in the views folder, your registration form or any kind of form will be like this:

{!! Form::open() !!}
{!! Form::label('email', 'Email') !!}
{!! Form::text('email', Input::old('email')) !!}
{!! Form::label('password', 'Password') !!}
{!! Form::password('password') !!}
{!! Form::text('honey_pot', '', array('style' =>'display:none')) !!}
{!! Form::submit('Register') !!}
{!! Form::close() !!}

In the controller file, you should write your validation rules like this:

public function store()
{
Validator::extend('honey_pot', function ($attribute, $value, $parameters) {
return $value == '';
});
$rules = array(
'email' => 'required|email',
'password' => 'required',
'honey_pot' => 'honey_pot'
);
$messages = array('honey_pot' => 'Nothing Here');
$validation = Validator::make(Input::all(), $rules, $messages);
if ($validation->fails()) {
return Redirect::to('register')->withErrors($validation)->withInput();
} else {
return "Awesome!!";
}
}

Don’t forget to add the use statements at the top of the controller file:

use Validator;
use Input;

In the above validation, we’ve created a new validator called honey_pot that checks for the field honey_pot and if the field is not empty, the rule will return false.

Now if any spambot tries to fill the form, it will fall in the honeypot field which should be zero length.

Creating a Middleware

You can apply this laravel spam protection technique for all Laravel forms, you can make a middleware to check for POST request if the honey_pot field is zero length or no.

First, create the middleware:

php artisan make:middleware HoneyBot

Then check for the honey_pot field in the middleware like this:

public function handle($request, Closure $next)
{
if($request->isMethod('POST') && count($request->honey_pot) != 0 ){
return redirect('register');
}
return $next($request);
}

And don’t forget to apply your middleware, you can apply it globally to all request by adding the middleware to the middleware array in app/HTTP/kernel.php  file.

\App\Http\Middleware\HoneyBot::class

Now you can remove the validation rules from the form and rely on the middleware Great!!

Another Solution

Some spam bots may be clever enough to detect those hidden fields and never touch it, so what is the solution for this?

Well, you can add another hidden field that carries the time of the form submission and when the user or the bot submits the form, you can check the time difference between the render time and the submissions time, if it’s less than three seconds or so, that means the submission comes from a spam bot.

There are ready to use packages for this purpose, but as you can see, the solution is in one simple line.

Again, I’m not saying that Google reCaptcha is not a good option, it’s actually an awesome option. If you have the chance to use it, don’t hesitate.

I hope you find the post useful. Keep coming back.

Thank you.