39 lines
1.3 KiB
JavaScript
39 lines
1.3 KiB
JavaScript
/**
|
|
* Anti-spam middleware for public forms.
|
|
*
|
|
* Two complementary checks:
|
|
* 1. Honeypot — a hidden field (`company_website`) that real users never see.
|
|
* If it is filled, the request is a bot. We respond with a fake success
|
|
* so the bot does not learn it was detected.
|
|
* 2. Time trap — a `form_started_at` timestamp set by the client when the form
|
|
* is rendered. Submissions faster than MIN_FILL_MS are almost certainly bots.
|
|
*
|
|
* Both fields are stripped from req.body before reaching route handlers.
|
|
*/
|
|
const MIN_FILL_MS = 2000 // 2 seconds
|
|
|
|
export function antiSpam(req, res, next) {
|
|
const { company_website, form_started_at } = req.body || {}
|
|
|
|
// Honeypot filled → silently pretend success
|
|
if (company_website) {
|
|
return res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
|
|
}
|
|
|
|
// Time trap → too fast to be human
|
|
if (form_started_at) {
|
|
const elapsed = Date.now() - Number(form_started_at)
|
|
if (Number.isFinite(elapsed) && elapsed >= 0 && elapsed < MIN_FILL_MS) {
|
|
return res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
|
|
}
|
|
}
|
|
|
|
// Clean up internal fields before route handlers use req.body
|
|
if (req.body) {
|
|
delete req.body.company_website
|
|
delete req.body.form_started_at
|
|
}
|
|
|
|
next()
|
|
}
|