search

ElyssaW / contact-form-tutorial

46 stars 13 forks source link

Security concern about Contact endpoint #3

Open fescobar opened 2 years ago

fescobar commented 2 years ago

I see your /contact endpoint is public because you need access to request and send the email from your application. In that way, everybody has access to do the same. Everybody can request directly your endpoint sending emails using your SMTP server because it's not protected using any security mechanism.

BWBama85 commented 1 year ago

Is this true? If so, how do we prevent it?

fescobar commented 1 year ago

I haven't found a solution from ReactJS, but maybe recaptcha 3 can help you. https://developers.google.com/recaptcha/docs/v3

BWBama85 commented 1 year ago

Thanks, I decided to go with Cloudflare Turnstile.

On Mon, Nov 21, 2022 at 3:32 PM fescobar @.***> wrote:

I haven't found a solution from ReactJS, but maybe recaptcha 3 can help you. https://developers.google.com/recaptcha/docs/v3

— Reply to this email directly, view it on GitHub https://github.com/ElyssaW/contact-form-tutorial/issues/3#issuecomment-1322674613, or unsubscribe https://github.com/notifications/unsubscribe-auth/AJZZDAO3OQA5OG3S6QHVCFDWJPS5RANCNFSM52QXG5NQ . You are receiving this because you commented.Message ID: @.***>