tl/dr: Client authentication in the browser is useless because browser-based bots will automatically authenticate themselves, and
browser-less bots will get stopped by much simpler methods anyway.
This isn't really a surprise, because "client authentication" isn't
really effective for browsers (and is only slightly effective for other "kinds" of clients). Captcha, unfortunately, is the only real solution,
although it cannot protect you from targeted attacks.
In order to protect against spam bots, you first have to understand how they work. There are of course a ridiculous number of varieties, but I'll focus on two general "types" (keep in mind that I've chosen these categories somewhat arbitrarily):
- Many simple bots request pages from the website using a non-browser HTTP client (for simplicity, imagine they use curl). They then parse the HTML looking for forms. If they find one they also look at the inputs on the form, decide on how to "fill out" the inputs, build an HTTP request with their data, and then send it off to the url of the
action property on the form. Pretty simple. They will also fake details in the request headers (
User-Agent, etc...) to look more like a regular user.
- However there are "fancier" bots out there that actually use browsers. You can build your own bot using something like selenium which effectively lets you automate browsing the web using an actual browser. The bot uses Selenium to load up a page in the browser, click on input forms, send in keyboard input, and then click on the submit button.
Protecting against "simple" bots
not_a_bot=true to the request data), and submit it with Ajax. The server then rejects any requests that don't include that
So, will your authentication step help? Yes! However, only by accident, and there are much simpler ways to accomplish the same thing.
Protecting against "fancier" bots
This means that whether you secure your form by adding the
How do you stop these bots from filling out your forms? There's only one cost-effective solution: a captcha system (although even that isn't a guarantee).
DDoS is not even worth a mention. A DDoS attack works by simply flooding the server with so much traffic that it cannot keep up. While there are some kinds of DDoS attacks that might be prevented by trying to ignore submissions from bots, the most common kind won't be. Many DDoS attacks work by simply sending so much network traffic to your infrastructure that there is not enough bandwidth to keep up. When that happens there is nothing that can be done at the server level to stop the DDoS attack. Completely different strategies (mainly at the network-level) are required there. Whoever suggested that this might help against a DDoS simply doesn't understand how such attacks work.