CODEWITHSUNDEEP
ruby-on-railshttpspam-prevention
John Topley
John Topley

Reputation: 115372

What's the best way to handle spammers sending unwanted POST data?

My Ruby on Rails blog application is getting a lot of comment spam for a particular blog post even though comments are closed and the comment form is no longer there. The comments are filtered by Akismet so they're not visible, but I'm not sure how my app should best respond to these requests.

I thought about simply redirecting to the post page, or responding with an HTTP 404 or perhaps a 422. What do you think is the best course of action?

Upvotes: 3

Views: 355

Answers (5)

Ned Batchelder
Ned Batchelder

Reputation: 375634

Since you have control over the application, you can simply ignore the comment post, and return a 200 code anyway. Why give the spammer even the information that there was a problem?

If you want to try other techniques to prevent spam in the future, I've had great luck with Stopping Spambots with Hashes and Honeypots.

Upvotes: 1

BvuRVKyUVlViVIc7
BvuRVKyUVlViVIc7

Reputation: 11811

Maybe this brings you some information: Gem-idea: Automatic spam protection with captcha in before_filter when HTTP-method is post,put or delete

Upvotes: 1

Artyom
Artyom

Reputation: 31243

Make your action like action="/some-strange-post-address-41345234523-something" And add action attribute using javascript.

Most of spammers do not run javascript engine (since it is very hard to develop one) thus they would not know the action address for posting information...

For my blog it reduced the spam from 10-20 messages per day to 2-3 per year, and all of them seems to be added by real human beings.

Upvotes: 2

user151323
user151323

Reputation:

Since you are not accepting comments any longer, you wish to spend as little resources as possible on those requests.

As soon as you detect a POST request, return 404 code or just close the connection.

Upvotes: 1

Greg Hewgill
Greg Hewgill

Reputation: 993343

If your only goal is to thwart attempted spammers, any error result code would be fine. The spammer software isn't going to even look at it anyway.

Upvotes: 3

Related Questions