包简介

Middleware to implement a honeypot spam prevention

README 文档

README

Middleware to implement a honeypot spam prevention. This technique is based on creating a input field that should be invisible and left empty by real users but filled by most spam bots. The middleware check in the incoming requests whether this value exists and is empty (is a real user) or doesn't exist or has a value (is a bot) returning a 403 response.

Requirements

Installation

This package is installable and autoloadable via Composer as middlewares/honeypot.

composer require middlewares/honeypot

Example

$dispatcher = new Dispatcher([
	new Middlewares\Honeypot()
]);

$response = $dispatcher->dispatch(new ServerRequest());

Usage

In your forms, you have to include a <input> element that will be used as trap:

<html>
    <head>
        <style type="text/css">
            input[name="hpt_name"] { display: none; }
        </style>
    </head>
    <body>
        <form method="POST">
            <!-- This is the honeypot -->
            <input type="text" name="hpt_name" aria-label="Please, do not fill this input">

            <label>
                User:
                <input type="text" name="username">
            </label>
            <label>
                Password:
                <input type="password" name="password">
            </label>
        </form>
    </body>
</html>

The middleware by default expect the input name is hpt_name but you can change it. Note also the css code that hide the honeypot, so users do not see anything, only robots. You may need to add some accesibility attributes like aria-label for screen readers.

//Check the default "htp_name" value
$honeypot = new Middlewares\Honeypot();

//Check other value, for example "nobots"
$honeypot = new Middlewares\Honeypot('nobots');

Optionally, you can provide a Psr\Http\Message\ResponseFactoryInterface as the second argument to create the error response (403) when spam is detected. If it's not defined, Middleware\Utils\Factory will be used to detect it automatically.

$responseFactory = new MyOwnResponseFactory();

$honeypot = new Middlewares\Honeypot('htp_name', $responseFactory);

Helpers

getField

This static method is provided to ease the creation of the input field, accepting two arguments: the input name and a label used for screen readers. If no name is provided, use the same name passed previously to the middleware.

Example:

<form method="POST">
    <?= Middlewares\Honeypot::getField('htp_name', 'Please, do not fill this input') ?>
    <label>
        User:
        <input type="text" name="username">
    </label>
    <label>
        Password:
        <input type="password" name="password">
    </label>
</form>

getHiddenField

This static method generates the input field just like getField() does, but adds inline CSS to hide the field directly. Note: This may be easier to detect for some bots. If you want to get creative with hiding the field, use getField() in combination with custom CSS (or JS).

<form method="POST">
    <?= Middlewares\Honeypot::getHiddenField() ?>
    <label>
        User:
        <input type="text" name="username">
    </label>
    <label>
        Password:
        <input type="password" name="password">
    </label>
</form>

Please see CHANGELOG for more information about recent changes and CONTRIBUTING for contributing details.

The MIT License (MIT). Please see LICENSE for more information.

middlewares/honeypot 适用场景与选型建议

middlewares/honeypot 是一款基于 PHP 开发的 Composer 扩展包，目前已累计 2.61k 次下载、GitHub Stars 达 14，最近一次更新时间为 2016 年 10 月 09 日，在 PHP 生态内属于活跃度较高的组件。

它主要适用于以下技术方向：「http」「security」「server」「middleware」「Honeypot」「psr-7」等业务场景。在实际项目中，围绕这些方向常见需要落地的问题包括：接口对接、性能调优、并发安全、与既有框架（Laravel / ThinkPHP / Yii / Webman 等）的兼容适配，以及生产环境的日志埋点与稳定性保障。

我们在过去多个企业项目中使用过 middlewares/honeypot 或与其功能相近的方案，如果你在选型或落地过程中遇到问题，例如 版本兼容、二次改造、私有化封装、与内部系统对接、生产 BUG 排查，欢迎联系我们协助评估。

围绕 middlewares/honeypot 我们能提供哪些服务？

定制开发 / 二次开发

基于 middlewares/honeypot 在你已有业务上做功能扩展、字段裁剪、UI 适配、与内部账号 / 权限 / 日志系统的深度对接。

BUG 修复 & 性能优化

线上偶发问题、内存泄漏、慢查询、并发异常等排查修复；针对高流量场景做缓存、队列、索引层面的调优。

项目外包 & 长期维护

承接完整的项目从需求 → 设计 → 开发 → 上线 → 长期运维；也可按月提供技术保姆服务。

yvsm@zunyunkeji.com QQ：316430983 微信：yvsm316 西安尊云信息科技 · 专注 PHP / Go / 分布式系统研发

与 middlewares/honeypot 相关的其它包

同方向 / 同关键字的高下载量 PHP Composer 包推荐，方便对比选型：

g4/data-repository 0

repository php library

gener1c-code/oauth2-server 0

A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API.

sil/route-security-bundle 7

Provide a way to secure accesses to all routes of an symfony application.

eftec/securityonemysql 6

It's a barebone security class written on PHP

stefangabos/zebra_form 96

A jQuery augmented PHP library for creating and validating HTML forms

bugbuster/integrity_check 3

Contao CMS integrity check for some files