I have a public sign up site, and when they click submit, a verification text message goes out to the phone number specified in sign up by calling an aspx page via ajax. I don't want spam bots sending out text messages that I pay for.
I noticed that google's noCaptcha feature with the simple check box has a lot of great things. But the most important feature it has is that it only accepts requests from ip addresses or domain name you designate. Good. And to do that, it has to check the http referer in the request. So what if the browser sending it or the firewall surrounding it erases http referer? Then I guess captcha doesn't work in that situation and gives back improper ip address or domain name error, or whatever it gives out and I have to handle that.
So my question is why does noCaptcha even need to be used? If I can check the referer ip address or domain name in the page that receives the request to send out the text message, and reject (or do whatever) if referrer is blank or not my ip address or domain name (because a spam script will be executing on the spammer's server or ip address or domain name), then am I not doing the same thing as noCaptcha and don't need it?
Seems like if a spammer's script is running on another ip address or domain name invoking the js ajax calls it found on my page via scraping, the referrer ip address or domain name will either be blank, or the real spammer's address, as it seems that http referrer can't be spoofed, only excluded or be changed through proxies, none of which will be my ip address or domain.
Either way, is this not just as effective and gets to the bottom line? If noCaptcha can't accept requests without a proper and correct http referer, then is my check no less than theirs? Either solution will not work if there is a firewall that prevents http referrer from being specified or a spam bot script that does not specify it. So what am i buying (even though it's free) from noCaptcha if it has the same limitations of the idea I am proposing where the check is done on the requested page that will send out the text message?
I'm looking for people to tell me why my captcha replacement approach will not actually work