Download the PHP package lukeusher/laravel-honeypot without Composer
On this page you can find all versions of the php package lukeusher/laravel-honeypot. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download lukeusher/laravel-honeypot
More information about lukeusher/laravel-honeypot
Files in lukeusher/laravel-honeypot
Package laravel-honeypot
Short Description Preventing spam submitted through forms
License MIT
Homepage https://github.com/spatie/laravel-honeypot
Informations about the package laravel-honeypot
Preventing spam submitted through forms
This is a fork of spatie/laravel-honeypot that can be used with Laravel 6 (LTS) after being upgraded to PHP8. The upstream package only retains support for PHP7 with Laravel 6.
When adding a form to a public site, there's a risk that spam bots will try to submit it with fake values. Luckily, the majority of these bots are pretty dumb. You can thwart most of them by adding an invisible field to your form that should never contain a value when submitted. Such a field is called a honeypot. These spam bots will just fill all fields, including the honeypot.
When a submission comes in with a filled honeypot field, this package will discard that request. On top of that this package also checks how long it took to submit the form. This is done using a timestamp in another invisible field. If the form was submitted in a ridiculously short time, the anti spam will also be triggered.
After installing this package, all you need to do is to add a @honeypot
Blade directive to your form.
Video tutorial
In this video, which is part of the Mailcoach video course, you can see how the package can be installed and used.
Support us
We invest a lot of resources into creating best in class open source packages. You can support us by buying one of our paid products.
We highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using. You'll find our address on our contact page. We publish all received postcards on our virtual postcard wall.
Installation
You can install the package via composer:
Optionally, you can publish the config file of the package.
This is the content of the config file that will be published at config/honeypot.php
:
Usage
First, you must add the @honeypot
blade directive to any form you wish to protect.
@honeypot
will add two fields: my_name
and my_time
(you can change the names in the config file).
Next, you must use the Spatie\Honeypot\ProtectAgainstSpam
middleware in the route that handles the form submission. This middleware will intercept any request that submits a non empty value for the key named my_name
. It will also intercept the request if it is submitted faster than the encrypted timestamp that the package generated in my_time
.
If you want to integrate the Spatie\Honeypot\ProtectAgainstSpam
middleware with Laravel's built in authentication routes, wrap the Auth::routes();
declaration with the appropriate middleware group (make sure to add the @honeypot
directive to the authentication forms).
If your app has a lot of forms handled by many different controllers, you could opt to register it as global middleware.
Disabling in testing
By default, any protected form that is submitted in faster than 1 second will be marked as spammy. When running end to end tests, which should run as fast as possible, you probably don't want this.
To disable all honeypots in code, you can set the enabled
config value to false
.
Customizing the response
When a spammy submission is detected, the package will show a blank page by default. You can customize this behaviour by writing your own SpamResponse
and specifying its fully qualified class name in the respond_to_spam_with
key of the honeypot
config file.
A valid SpamResponse
is any class that implements the Spatie\Honeypot\SpamResponder\SpamResponder
interface. This is what that interface looks like:
Even though a spam responder's primary purpose is to respond to spammy requests, you could do other stuff there as well. You could for instance use the properties on $request
to determine the source of the spam (maybe all requests come from the same IP) and put some logic to block that source altogether.
If the package wrongly determined that the request is spammy, you can generate the default response by passing the $request
to the $next
closure, like you would in a middleware.
Customizing the generated honeypot fields
To customize output generated by @honeypot
, you can publish the honeypot
view with:
The view will be placed in resources/views/vendor/honeypot/honeypotFormFields.blade.php
. This is the default content:
Events fired
Whenever spam is detected, the Spatie\Honeypot\SpamDetected
event is fired. It has the $request
as a public property.
Testing
Changelog
Please see CHANGELOG for more information on what has changed recently.
Alternatives
If you need stronger spam protection, consider using Google ReCaptcha or Akismet.
Contributing
Please see CONTRIBUTING for details.
Security
If you discover any security related issues, please email [email protected] instead of using the issue tracker.
Credits
- Freek Van der Herten
- All Contributors
This package was inspired by the Honeypot package by Maksim Surguy.
License
The MIT License (MIT). Please see License File for more information.
All versions of laravel-honeypot with dependencies
illuminate/contracts Version ^8.0
illuminate/encryption Version ^8.0
illuminate/http Version ^8.0
illuminate/support Version ^8.0
illuminate/validation Version ^8.0
nesbot/carbon Version ^2.0
spatie/laravel-package-tools Version ^1.6
symfony/http-foundation Version ^5.1.2