Web App Spam (hack attempt)

[Russ3]

I have a web app in which I implemented the "Allow site visitors to submit Web App items​" process from the manual.  It works great, however...

We're starting to get a TON of spam, which looks like an attempt to crack the site (I don't think it has been or will be successful, but...).  About 4000 entries on March 1.

But since this is a Web App and not a Web Form, I don't see, nor can I find online, any method of enabling a CAPTCHA or anything.  Is this possible?

Does anyone have any advice/solutions on this matter?

[Liam Dilley]

Hi there,

First thing is that web app items can only be submitted my logged in customers. So with that you either...

1. Are doing inline code and login for anonymous submissions which is a solution but not super secure.

2. You have an issue where something has been exposed and a bot or person is using login credentials to the front end part of the site and submitting those forms.

What you can do without captcha to avoid bots?

While not stopping every human interaction there is one simple step.

If you remove the form action then it is a form that does nothing. If you have that form action in say data-action="FORM action" in the form node and then on page load just for the form set the action based on that data value the form will work but most bots wont be able to submit the form.

[Stephen_Blignault1]

I second what Liam said.

1. Web apps submissions work on the premise that the user is logged in - hence preventing spam bots and google from seeing the form source.
2. Set your form action to blank, confusing spam bots. Example: <form action="" data-action="/CustomContentProcess.asx...">. Then within your submit function you read the data-action attribute and paste into action attribute and then submit the form.

Good luck!

[Russ3]

I can't mark this as "correct" yet, but I've googled this solution, have seen other examples, and implemented it on the form in question.

The form submits and works fine, I suppose time will tell if it works or not. 

Thank you for the suggestion.