search

umbraco / Umbraco.Forms.Issues

Public issue tracker for Umbraco Forms
30 stars 0 forks source link

GDPR compliant captcha integration #1306

Open bjarnef opened 1 month ago

bjarnef commented 1 month ago

Google reCAPTCHA is a great option to prevent spam through Umbraco Forms, unfortunately it isn't GDPR compliant of this time writing.

I found these options:

Turnstile could perhaps make sense to have an integration for as Cloudflare is used on Umbraco Cloud. There are some examples here: https://github.com/cloudflare/turnstile-demo-workers/blob/main/src/explicit.html#L74-L85

bjarnef commented 1 month ago

@AndyButland are there any considerations regarding this at the moment? We have a project where Google reCAPTCHA v3 isn't an option. We tried the Honeypot technique https://marketplace.umbraco.com/package/our.umbraco.honeypot , but bots/crawlers are too smart nowadays and can bypass this. It helped somewhat, but not much :)

AndyButland commented 1 month ago

Nothing currently, but thanks for putting in on the radar. The out-of-the-box reCAPTCHAs are custom fields, and could be that some of these other offerings could be provided in a similar way.

bjarnef commented 3 days ago

@AndyButland we implemented Turnstile using implicit rendering. The day before it had 500 forms entries. After enable Turnstile and running for a day it has only received 4 forms entries, where 2 was from our test. In the log it has logged form submissions, but most can't be verified by Turnstile.

It has been very affective for now and more than reCAPTCHA v3 on other projects, which has still received spams with default score threshold at 0.5

Besides that Turnstile is GDPR compliant. which reCAPTCHA v3 isn't.