search

lukeraymonddowning / honey

A spam prevention package for Laravel, providing honeypot techniques, ip blocking and beautifully simple Recaptcha integration. Stop spam. Use Honey.
MIT License
402 stars 23 forks source link

Livewire Form Resubmission #13

Closed usernotnull closed 3 years ago

usernotnull commented 3 years ago

If a livewire form had errors and Honey returns pass, yet the form needs a resubmission, recaptcha will give us a problem with duplication:

The following errors were thrown when trying to resolve the recaptcha token: timeout-or-duplicate

Adding a public field to the livewire to save the previous honey result is not safe, as it would be exposed to the front-end.

Any thoughts?

lukeraymonddowning commented 3 years ago

Great point! Never even thought of that. I wonder if there is a hook that we can listen for in JS and regenerate when it's fired?

I'll take a look today. Any suggestions are very welcome.

usernotnull commented 3 years ago

I was thinking if you can expose a way to manually regenerate the token, but maybe there's a better way to automatically handle it through honey. I'll take a look again when I'm off.

lukeraymonddowning commented 3 years ago

Just after a quick peruse, it might be best to use the message.received JS hook, and ask for all tokens to be regenerated when that happens on a component that includes honey recaptcha. Thinking about it, they could have checked the recaptchaPasses method in an update flow, and want to check it again, so it's not just validation errors that would cause this.

Thoughts?

usernotnull commented 3 years ago

On a related note, I also randomly received a “missing input response” from the captcha in a livewire component, for unknown reasons and couldn't consistently replicate it.

lukeraymonddowning commented 3 years ago

Okay, I've started a PR for this in #14. Let me know what you think. It does cause a lot of requests for new tokens if an input does not use lazy or defer. I wonder if instead we could emit an event when the token has been checked that sends a requirement for a new token...

lukeraymonddowning commented 3 years ago

Okay, fixed the large number of requests. Livewire will now dispatch a browser event after a token gets checked (this can be done manually too), so it only refreshes the token when it absolutely needs to.

usernotnull commented 3 years ago

I tested with the PR, works well!