-2

I am asking this here because, my understanding of the CGI specification is that authentication should be handled by apache rather that by the script: https://www.rfc-editor.org/rfc/rfc3875#section-3.

I put up a webpage advertising a particular birthday party. A simple html page served by apache2 on ubuntu server 12.04. I have a link on the page to a cgi script-Python-that asks the requester to submit text values that will be formatted and relayed in an email to the bithrday boy. What's a simple way to authenticate that a human being is filling out the form, so that I can avoid having the birthday boy receiving spam. Using standard CGI because I do not expect an overload of concurrent requests.

4
  • Implement something like ReCAPTCHA or SolveMEDIA?
    – tombull89
    Apr 19, 2013 at 14:19
  • I think you are miss-reading that specification. "When processing the client request, it is responsible for implementing any protocol or transport level authentication and security." This is saying the web server is to be responsible for things like SSL negotiation, and certificates. Not that it should handle all authentication from your application. Validating that an email is valid, or a the source of a request is valid, is not a transport level check.
    – Zoredache
    Apr 19, 2013 at 16:43
  • I think your correct and this goes into application level authentication. That's probably why every method I've seen suggested is at the script level. Apr 19, 2013 at 16:46
  • This has been discussed extensively at our sister site Webmasters where you may want to search for better answers. Apr 20, 2013 at 6:38

1 Answer 1

1

The easiest and best way that I've found is to put an input form on your page that will get hidden either by javascript or by CSS. Something like:

<link href="/styles.css" rel="stylesheet" type="text/css" media="all" />
<form action="/birthday.php" method="post">
  <p>Email: <input type="text" name="email" /></p>
  <p>Name: <input type="text" name="name" /></p>
  <p>Phone: <input type="text" name="phone" /></p>
</form>

In this case, we'll use phone as our secret human verification input. In your styles.css you should have:

input[name="phone"] {
  display: none;
}

In this case, the "phone" input type will be hidden by every real human's browser and won't be submitted with the form. (Most) spambots won't load and parse the external CSS file, so you can then check the existence of the "phone" input's existence in your script:

PHP code:

if (isset($_POST['phone'])) {
  // this is spam, but don't let them know
  echo 'thanks!';
  exit;
}

99% chance you won't get spam. If you did, you could go one step further and use javascript to disable the form field:

$(function() {
  $('input[name="phone"]').hide();
});

This puts the onus on the spammer to load and parse your CSS (or javascript) file and is super easy to implement.

Not the answer you're looking for? Browse other questions tagged .