I'm working on a Java Spring with a team and have been facing form spam issues. We are seeing a large number of requests that use generated & falsified information (ie everyone's names are generic, emails follow the same syntax, birthdays are 1/1 of various years, and all forms are completed in the same amount of time). Due to the uniform nature of these requests, I can reliably assume automation is being used.
Without introducing additional external dependencies into the project (eg Captcha), I would like to set up a system that can make automated form submissions as difficult as possible. My current approach would utilize five different approaches in tandem.
- Measuring keystroke events per form/field
- Hidden honeypot fields
- Measure mouse events per page
- Server-side timing
- IP blocking
The first three would obviously be front-end and generally focus on determining how "human" the user is behaving. The latter two are to determine if the user is coming from a flagged IP or is submitting data repeatedly and within the same amount of time as their last submission. The nature of the application allows and encourages the same user to enter and submit data more than once, but the vast majority of users don't submit more than a few times.
My number one priority is reducing spam, with a close number two being the minimization of false positives. Each of the five elements wouldn't be an absolute ruling, but if two (or more) of these flags is triggered, the user is flagged and booted.