search

markets / invisible_captcha

🍯 Unobtrusive and flexible spam protection for Rails apps
https://rubygems.org/gems/invisible_captcha
MIT License
1.15k stars 66 forks source link

Timestamp detection triggers after validation fail re-render #81

Closed vfonic closed 3 years ago

vfonic commented 3 years ago

I've encountered the following issue with default timestamp threshold. I tried to submit a record and forgot to tick off the required "I accept T&C" checkbox. I then just checked it and clicked "Submit" again. This actually triggered captcha because I managed to resubmit within the timestamp threshold.

I've read this issue, but couldn't figure what I should do in this case: Timestamp detection #6

What do you recommend?

Should I disable the timestamp threshold? Should I set it to lower value?

Thanks!

Here's the repro case: https://github.com/vlado/earthquake-croatia/issues/66

markets commented 3 years ago

Hi @vfonic 👋🏼 and thanks for trying this gem. I understand your situation, however this is kind of a "trade-off", you can read more in these threads: #24, #53.

TL;DR at the end, having a fresh timestamp every page view is more effective to "block" bots, most of form validations can be handled in front-end in a more UX way (or with simple HTML 5), and eventually you can customize the threshold per action, so you can put a "small" value in certain forms. In your case, I'd personally go with an HTML required attribute.

vfonic commented 3 years ago

That's a great idea and should help us go around the issue. I'll do that, thanks!

I guess I can close this ticket then. Thanks again!