The script injects the email collection form widget into a div tag on the developer website. When a user submits the form, it makes a POST request to an endpoint hosted on our server. We use recaptcha to validate all requests.
There are some security implicatons:
- Bad actor can spam the endpoint with bad email addresses.
- Since the widget is embedded on the developer page, they can use the widget for nefarious purposes and have our name on it.
How can I address the security issues that comes with an embeddable widget? All requests go through HTTPS. Recaptcha is used to help against spam/abuse. Maybe I can use a site key/referrer header to validate that the request is coming from a trusted website?
Another option is to use an iframe hosted on my website to show the widget.