Honeypot spam prevention for Laravel applications

Related tags

Security Honeypot
Overview

Honeypot spam prevention for Laravel applications

How does it work?

"Honeypot" method of spam prevention is a simple and effective way to defer some of the spam bots that come to your site. This technique is based on creating an input field that should be left empty by the real users of the application but will most likely be filled out by spam bots.

This package creates a hidden DIV with two fields in it, honeypot field (like "my_name") and a honeytime field - an encrypted timestamp that marks the moment when the page was served to the user. When the form containing these inputs invisible to the user is submitted to your application, a custom validator that comes with the package checks that the honeypot field is empty and also checks the time it took for the user to fill out the form. If the form was filled out too quickly (i.e. less than 5 seconds) or if there was a value put in the honeypot field, this submission is most likely from a spam bot.

Installation:

In your terminal type : composer require msurguy/honeypot. Or open up composer.json and add the following line under "require":

{
    "require": {
        "msurguy/honeypot": "^1.0"
    }
}

Next, add this line to 'providers' section of the app config file in app/config/app.php:

'Msurguy\Honeypot\HoneypotServiceProvider',

Add the honeypot facade:

'Honeypot' => 'Msurguy\Honeypot\HoneypotFacade'

At this point the package is installed and you can use it as follows.

Usage :

Add the honeypot catcher to your form by inserting Honeypot::generate(..) like this:

Laravel 5 & above:

{!! Form::open('contact') !!}
    ...
    {!! Honeypot::generate('my_name', 'my_time') !!}
    ...
{!! Form::close() !!}

Other Laravel versions:

{{ Form::open('contact') }}
    ...
    {{ Honeypot::generate('my_name', 'my_time') }}
    ...
{{ Form::close() }}

The generate method will output the following HTML markup (my_time field will contain an encrypted timestamp):

">

  

After adding the honeypot fields in the markup with the specified macro add the validation for the honeypot and honeytime fields of the form:

'honeypot', 'my_time' => 'required|honeytime:5' ); $validator = Validator::make(Input::get(), $rules); ">
$rules = array(
    'email'     => "required|email",
    ...
    'my_name'   => 'honeypot',
    'my_time'   => 'required|honeytime:5'
);

$validator = Validator::make(Input::get(), $rules);

Please note that "honeytime" takes a parameter specifying number of seconds it should take for the user to fill out the form. If it takes less time than that the form is considered a spam submission.

That's it! Enjoy getting less spam in your inbox. If you need stronger spam protection, consider using Akismet or reCaptcha

Testing

If you want to test the submission of a form using this package, you might want to disable Honeypot so that the validation passes. To do so, simply call the disable() method in your test:

Honeypot::disable();

$this->visit('contact')
    ->type('User', 'name')
    ->type('[email protected]', 'email')
    ->type('Hello World', 'message')
    ->press('submit')
    ->see('Your message has been sent!');

Credits

Based on work originally created by Ian Landsman: https://github.com/ianlandsman/Honeypot

License

This work is MIT-licensed by Maksim Surguy.

Comments
  • Make testing easier by adding a disable() method

    Make testing easier by adding a disable() method

    This PR is related to issue #39 and is a suggestion to allow easy Validator mocking:

    HoneypotValidator::shouldReceive('validateHoneytime')
        ->once()
        ->andReturn(true);
    

    I have updated the documentation.

    opened by LaurentEsc 13
  • Improved registering macro

    Improved registering macro

    This fixes cases where the honeypot marco is not added where the form builder hasn't been resolved through the IoC, i.e. if your extending Laravel's form builder

    opened by garygreen 6
  • FatalErrorException in ProviderRepository.php line 150:

    FatalErrorException in ProviderRepository.php line 150:

    Honeypot is working fine in my localhost using windows

    but after i upload my update in my server "Linux"

    1. composer.json
    2. vendor/msurguy/ all files

    Then when i access my website i have the error below: FatalErrorException in ProviderRepository.php line 150: Class 'Msurguy\Honeypot\HoneypotServiceProvider' not found

    Thanks In advanced

    opened by jomarocampo 5
  • Laravel 5 Release

    Laravel 5 Release

    Is there a release for Laravel 5 yet? I'm trying to upgrade and just using the normal install on the ReadMe causes an error due to HTLM being deprecated.

    PHP Fatal error: Class 'Illuminate\Html\FormBuilder' not found in /vagrant/biospex/vendor/msurguy/honeypot/src/Msurguy/Honeypot/HoneypotServiceProvider.php on line 91

    opened by rbruhn 5
  • FormBuilder not found on L5

    FormBuilder not found on L5

    I'm getting the following error using Laravel 5.0.31:

    FatalErrorException in HoneypotServiceProvider.php line 91:
    Class 'Illuminate\Html\FormBuilder' not found
    in HoneypotServiceProvider.php line 91
    at FatalErrorException->__construct() in HandleExceptions.php line 131
    at HandleExceptions->fatalExceptionFromError() in HandleExceptions.php line 116
    at HandleExceptions->handleShutdown() in HandleExceptions.php line 0
    at HoneypotServiceProvider->registerFormMacro() in HoneypotServiceProvider.php line 57
    at HoneypotServiceProvider->Msurguy\Honeypot\{closure}() in Application.php line 862
    at call_user_func:{/Users/mario/workspace/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Application.php:862}() in Application.php line 862
    at Application->fireAppCallbacks() in Application.php line 690
    at Application->boot() in BootProviders.php line 15
    at BootProviders->bootstrap() in Application.php line 183
    at Application->bootstrapWith() in Kernel.php line 199
    at Kernel->bootstrap() in Kernel.php line 110
    at Kernel->sendRequestThroughRouter() in Kernel.php line 84
    at Kernel->handle() in index.php line 53
    in server.php line 21
    at {main}() in server.php line 0
    
    opened by mgallegos 4
  • Remove formbuilder macro, use the facade.

    Remove formbuilder macro, use the facade.

    @msurguy how do you feel about this one? Of course a breaking change so would need a major version bump but I think currently a lot of issues spawn from usage of the macro on FormBuilder. These issues range from supporting legacy Laravel < 4.2, newer Laravel >= 4.2.. and now that illuminate/html has been deprecated it's been replaced with another package called Laravel Collective which runs under a different namespace but is essentially the new illluminate/html.

    That's a lot to support and keep up with when all it's doing is just adding a macro which isn't really worth it imo. Doing Honeypot::getFormHtml(...) vs Form::honeypot(...) isn't really much of a difference.

    As this is a breaking change, I've also added in this commit a rename of the method getFormHtml to simply generate -- it's possibly a nice time to make the change as read's nicer in it's usage:

    {{ Honeypot::getFormHtml() }} {{ Honeypot::generate() }}

    Let me know what you think :smile:

    opened by garygreen 3
  • Lang files won't work

    Lang files won't work

    Service Provider boot happens before anything else. You're loading translated messages here: https://github.com/msurguy/Honeypot/blob/master/src/Msurguy/Honeypot/HoneypotServiceProvider.php#L19

    So if I add

    App::setLocale('another lang');
    

    to my app/start/global.php, it's too late, because the english (default) was already loaded.

    opened by antonioribeiro 3
  • Duplicate Id when using the same Honeypot

    Duplicate Id when using the same Honeypot

    I have two of exactly the same forms on a page, which both include the same Honeypot::generate() method. When doing an HTML validity check (https://validator.w3.org) It says there are duplicate ids on the containing div ..._wrap.

    1. Is this wrapper necessary?
    2. Is there a way around using the same id on this element
    opened by Benjyclay 2
  • Replace L4 Exception with generic Exception to support both L4 and L5

    Replace L4 Exception with generic Exception to support both L4 and L5

    The class name for the DecryptException has changed in L5. Instead of: \Illuminate\Encryption\DecryptException

    it is now: \Illuminate\Contracts\Encryption\DecryptException

    So in order to support both L4 and L5 integrations I suggest to change the catch to a generic Exception class.

    opened by frankmichel 2
  • Need to catch Illuminate\Encryption\DecryptException

    Need to catch Illuminate\Encryption\DecryptException

    When a bot throws bad data at your form then the decrypt for the honeytime will throw a Illuminate\Encryption\DecryptException exception which does not get caught. I wrapped my validation in a try catch to handle it on my end for now, but it would be nice if this was handled internally.

    opened by MCNMike 2
  • Add the Validation to where ?

    Add the Validation to where ?

    I followed the steps up until adding the honeyPot to the markup pages or in other words ('view') but i don't understand where you add the validation to the HoneyPot ? Do you add it to the controller ? or you add it to the route ? can you please explain. I am doing a demo so after i ran artisan make:auth on a clean installation of Laravel 5.2.41 I added honey pot the main registration form. So i am thinking to add it to App\Http\Controllers\Auth\AuthController.php since the validator is already being used in that class. but i am not sure if thats the right way ? because i wanna also check the time of form being filled too. can someone please advise.

    thanks

    opened by MajdMaghamez 1
  • Array to string conversion

    Array to string conversion

    Ran the installer and updated package.json to dev-master but getting this error: [ErrorException]
    Array to string conversion

    Versions: PHP 7.1.7 Composer version 1.5.6 laravel/framework: 5.2.*

    opened by helderdb 0
  • Extending Honeypot

    Extending Honeypot

    I'm trying to extend Honeypot, and I'm running into issues.

    I created my service provider, and that works fine, but I can't seem to call the parent class methods.

    <?php
    
    namespace App\Extensions;
    
    use Honeypot;
    
    class MyHoneypot extends Honeypot
    {
    /**
     * Generate a new honeypot and return the form HTML
     * @param  string $honey_name
     * @param  string $honey_time
     * @return string
     */
    public function generate(array $honey_name, array $honey_time)
    {
        $honey_time_encrypted = parent::getEncryptedTime();
        // Encrypt the current time
    
        $html = '<div id="' . $honey_name . '_wrap" style="display:none;">' . "\r\n" .
                    '<input name="' . $honey_name . '" type="text" value="" id="' . $honey_name . '"/>' . "\r\n" .
                    '<input name="' . $honey_time . '" type="text" value="' . $honey_time_encrypted . '"/>' . "\r\n" .
                '</div>';
    
        return $html;
    }
    }
    

    I get the error Call to undefined method App\Extensions\MyHoneypot::getEncryptedTime().

    I also attempted to use Msurguy\Honeypot, but that, too, failed. It could not find the class.

    Any thoughts why?

    opened by hoppities 2
  • How can I mock this ?

    How can I mock this ?

    Hi, thank you for this nice package which works nicely.

    I am using it in a registration form and want to add an integration test to make sure the form can be filled and submitted properly. However, the form is filled too fast by my tests and the validation fails. I am looking for a way to mock the HoneypotValidator->validateHoneytime() method and make it return true during my test.

    Is there a way to do this ?

    Thank you

    opened by LaurentEsc 1
  • Does not recognize honeypot method

    Does not recognize honeypot method

    Might just be me but I'm getting: An exception has been thrown during the rendering of a template ("Method honeypot does not exist.") in my view. I'm using Twig and access your method as such, form_honeypot('hname', 'htime').

    I also have my own custom macros which I'm able to access as form_mymacroname('xxx') so I don't think it's the macro but I might be wrong on this.

    opened by enchance 36
Releases(1.1.7)
Owner
Maksim Surguy
MS in Tech Innovation, Design Tech at Amazon Past: dev @firstech, @nbcuniversal, creator of Bootsnipp, Drawingbots, Plotterfiles and many more.
Maksim Surguy
[OUTDATED] Two-factor authentication for Symfony applications 🔐 (bunde version ≤ 4). Please use version 5 from https://github.com/scheb/2fa.

scheb/two-factor-bundle ⚠ Outdated version. Please use versions ≥ 5 from scheb/2fa. This bundle provides two-factor authentication for your Symfony ap

Christian Scheb 389 Nov 15, 2022
Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campbell/security-core

Laravel Security Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campb

Graham Campbell 170 Nov 20, 2022
Laravel Automated Vulnerability Scanner

Todo Laravel Fingerprint Laravel Leak .env Laravel Debug Mode Laravel CVE-2018-15133 Laravel Ignition CVE-2021-3129 Insecure Deserialization with APP_

Carlos Vieira 52 Dec 4, 2022
Web Application Firewall (WAF) package for Laravel

Web Application Firewall (WAF) package for Laravel This package intends to protect your Laravel app from different type of attacks such as XSS, SQLi,

Akaunting 681 Jan 3, 2023
Replaces Laravel's built-in encryption with an encryption based on AWS KMS

Laravel Kms Encryption Introduction This package replaces Laravel's built-in encryption with an encryption based on AWS KMS. Two major features provid

Arnaud Becher 3 Oct 26, 2021
An SSL/TLS service for Laravel

An SSL/TLS service for Laravel. Use the openssl driver it includes or create your own custom driver.

null 1 Oct 31, 2021
Laravel and Lumen Source Code Encrypter

Laravel Source Encrypter This package encrypts your php code with phpBolt For Laravel and Lumen 6, 7, 8 Installation Usage Installation Step 1 At the

Siavash Bamshadnia 363 Jan 1, 2023
Automatic Encrypt and Decrypt your database data. Tested and used on Laravel 8

Laravel Encrypt Database Automatic Encrypt and Decrypt your database data. Tested and used on Laravel 8. I'm yet building the tests. Important Note th

Wellington Barbosa 2 Dec 15, 2021
Laravel Sail plugin to enable SSL (HTTPS) connection with Nginx.

Laravel Sail plugin to enable SSL (HTTPS) connection with Nginx.

Ryo Kobayashi 51 Dec 19, 2022
SPAM Registration Stopper is a Q2A plugin that prevents highly probable SPAM user registrations based on well-known SPAM checking services and other techniques

SPAM Registration Stopper [by Gabriel Zanetti] Description SPAM Registration Stopper is a Question2Answer plugin that prevents highly probable SPAM us

Gabriel Zanetti 2 Jan 23, 2022
Rah comment spam - Comment anti-spam plugin for Textpattern CMS

rah_comment_spam Packagist | Issues | Donate Rah_comment_spam provides customizable anti-spam tools for Textpattern CMS’ comment system. Set minimum a

Jukka Svahn 2 Apr 24, 2022
Simple customizable captcha script for bot prevention in php language.

phpCaptcha Simple customizable captcha script for bot prevention in php language. Usage <?php session_start(); $status = ""; if ($_SESSION['captcha']

Филип Арсовски 11 Oct 10, 2022
Bundle providing Honeypot field for the Form Builder in Ibexa DXP Experience/Commerce (3.X)

IbexaHoneypot Bundle providing Honeypot field for the Form Builder in Ibexa DXP Experience/Commerce (3.X) What is Honey pot? A honey pot trap involves

null 1 Oct 14, 2021
Corruption prevention mechanism against EU public governance institutions - reporting prevalence over persistent storage.

c2c-mvc.pbgroupeu A small scale - based on Composer dependencies - MVC - ORM application project. It can be used on low-intensity resources consumptio

Povilas Brilius 1 Oct 18, 2021
Honeypot type for Symfony forms

EoHoneypotBundle Honeypot for Symfony2 forms. What is Honey pot? A honey pot trap involves creating a form with an extra field that is hidden to human

Eymen Gunay 33 Dec 19, 2022
All In 1 Spam Tool For Termux Users Subscribe Us (Noob Hackers) some shit heads are trying to abuse this script so don't worry about them ...let them hallucinate ...but you are free to use this script

ABOUT TOOL : SPAMX is a all in one Bombing+Spam tool from this tool you can send anonymous messages to your target without showing your real number an

N17R0 449 Jan 7, 2023
PHP client library for reCAPTCHA, a free service to protect your website from spam and abuse.

reCAPTCHA PHP client library reCAPTCHA is a free CAPTCHA service that protects websites from spam and abuse. This is a PHP library that wraps up the s

Google 3.3k Dec 23, 2022
Friendly Captcha anti-spam plugin for Joomla!

Friendly Captcha anti-spam plugin for Joomla! Register at https://friendlycaptcha.com to get your site and secret keys. Plugin Features Standard light

null 10 Dec 14, 2022
Akismet: Spam Protection for MODX

Akismet: Spam Protection for MODX Developed by modmore Introduction Akismet is an advanced spam protection service that uses AI to analyse form submis

modmore | More for MODX 3 Nov 12, 2021
WPBruiser {no- Captcha anti-Spam} (forked, updated)

=== WPBruiser {no- Captcha anti-Spam} === Contributors: mihche, knutsp Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_

Webfacing 2 Jul 26, 2022