Reduce Comment-Spam with CSRF protection?
CSRF (cross-site request forgeries) is security lingo for when a request (typically a POST form submission) is submitted to your site by someone NOT on your site. Read more about CSRF if you're not familiar with the concept.
Comment Spam is when a spammer automatically adds comments to your blog filled with links to their products. They do this by having their bots submit comments to your blog, via "add comment" form on your blog.
This is essentially a CSRF.
So, if one applies common anti-CSRF techniques (such as a hidden field with a session value) then the spammer's bot must first load the blog URL before submitting the field - and they must load the blog page again each and every time they wish to submit a comment.
Sure, this isn't a magic bullet for blog spam but i wonder how much it would reduce... (until the spammer wisens up of course).
http://jenseng.com/archives/000054.html made me think about this (He uses different submit url for the comments... which is similar to a token based approach).
Comment Spam is when a spammer automatically adds comments to your blog filled with links to their products. They do this by having their bots submit comments to your blog, via "add comment" form on your blog.
This is essentially a CSRF.
So, if one applies common anti-CSRF techniques (such as a hidden field with a session value) then the spammer's bot must first load the blog URL before submitting the field - and they must load the blog page again each and every time they wish to submit a comment.
Sure, this isn't a magic bullet for blog spam but i wonder how much it would reduce... (until the spammer wisens up of course).
http://jenseng.com/archives/000054.html made me think about this (He uses different submit url for the comments... which is similar to a token based approach).


0 Comments:
Post a Comment
<< Home