How to Prevent Spam in Laravel Forms with spatie/laravel-honeypot

Spam and abuse in web forms has been a challenge for web developers for a long time.Honeypot is an effective way to fight against these issues. Honeypots are traps designed to catch bots and prevent them from submitting forms. The spatie/laravel-honeypot package provides an easy and efficient way to implement honeypots in Laravel applications.We will walk you through the installation, configuration, basic and advanced usage of the package, and offer practical examples to help you get a good overview of how the package works.

Learn More

1. Installation

To use spatie/laravel-honeypot, you need to install the package using Composer. Open your terminal and run the following command:

composer require spatie/laravel-honeypot

After installing the package, you need to publish the configuration file if you want to customize the settings. Use the following Artisan command:

php artisan vendor:publish --provider="Spatie\Honeypot\HoneypotServiceProvider"

This command will create a configuration file located at config/honeypot.php. The configuration file allows you to set the names and attributes of the honeypot fields used in your forms.

2. Configuration

The default configuration should work for most use cases. However, to customize the honeypot settings, you can modify the config/honeypot.php file. This file includes settings for the honeypot field names and validation rules.

Here's an example configuration file with explanations:

return [ /* * The name of the honeypot field. */ 'honeypot_field_name' => 'my_honeypot_field', /* * The name of the honeypot field's value. */ 'honeypot_field_value' => 'dummy_value', /* * The name of the honeypot field's ID attribute. */ 'honeypot_field_id' => 'my_honeypot_field_id', /* * The name of the honeypot field's placeholder attribute. */ 'honeypot_field_placeholder' => 'Leave this field empty', ]

● honeypot_field_name: This is the name of the hidden field that bots are likely to fill out. It should be a name that is not obvious to human users.

● honeypot_field_value: This value is used as a placeholder to make it less suspicious. It's not necessary but can add an extra layer of deception.

● honeypot_field_id: The ID attribute of the honeypot field. This is useful for styling or JavaScript if needed.

● honeypot_field_placeholder: The placeholder text for the honeypot field. It should be a message that encourages bots to fill it out.

3. Basic Usage

To use the honeypot to the utmost efficiency in your forms, you need to add the honeypot fields to your form view and handle the validation in your controller.

Adding Honeypot Fields to Your Form:

In your Blade view file, add the honeypot field as a hidden input. It will be invisible to human users but visible to bots.

Using the <x-honeypot /> Blade Component:This is a simple way to add a honeypot field to any form.

Using the @honeypot Blade Directive:This is an alternative to the Blade component, achieving the same result.

<form method="POST" action="{{ route('form.submit') }}"> @honeypot <input name="username" type="text"> </form>

Routes: Make sure to add middleware on your form routes.

use App\Http\Controllers\UserController; use Spatie\Honeypot\ProtectAgainstSpam; Route::post('contact', [UserController::class, 'submit'])->middleware(ProtectAgainstSpam::class);

Customization

Manual Implementation of Honeypot:You can manually create a honeypot field without relying on Blade components or directives.

<form action="{{ route('form.submit') }}" method="POST"> <@csrf>   <input type="text" name="{{ config('honeypot.honeypot_field_name') }}" id="{{ config('honeypot.honeypot_field_id') }}" placeholder="{{ config('honeypot.honeypot_field_placeholder') }}" style="display:none;"> <button type="submit">Submit</button> </form>

Handling Honeypot Validation in the Controller: In your controller, you need to check if the honeypot field is filled. If it contains any value, it indicates a bot submission.

public function submit(Request $request) { // Check honeypot field if (!empty($request->input(config('honeypot.honeypot_field_name')))) { return response()->json(['error' => 'Spam detected!'], 403); } // Validate and process form data $validator = Validator::make($request->all(), [ 'name' => 'required|string|max:255', 'email' => 'required|email', // Other validations ]); if ($validator->fails()) { return back()->withErrors($validator)->withInput(); } // Process the form submission or save the data in DB // ... return response()->json(['success' => 'Form submitted successfully']); }

In the above example, if the honeypot field contains any value, the request is rejected with a 403 Forbidden status code. Otherwise, the form is validated and processed as normal.

Customizing Honeypot Field Names: To use different field names or multiple honeypots, update the config/honeypot.php file with your desired field names and values. You can use this to adapt the honeypot technique to various form structures.

Using Multiple Honeypots: Implementing multiple honeypots can enhance spam prevention by adding more hidden fields. Here’s how to do it:

Form with Multiple Honeypots:

<form action="{{ route('form.submit') }}" method="POST"> <@csrf>   <input type="text" name="honeypot1" style="display:none;"> <input type="text" name="honeypot2" style="display:none;"> <button type="submit">Submit</button> </form>

Controller Handling Multiple Honeypots:

public function submit(Request $request) { // Check multiple honeypot fields if (!empty($request->input('honeypot1')) || !empty($request->input('honeypot2'))) { return response()->json(['error' => 'Spam detected!'], 403); } // Validate and process form data $validator = Validator::make($request->all(), [ 'name' => 'required|string|max:255', 'email' => 'required|email', // Other validations ]); if ($validator->fails()) { return back()->withErrors($validator)->withInput(); } // Process the form submission or save it in DB // ... return response()->json(['success' => 'Form submitted successfully']); }

When integrating honeypots, it's important to provide clear feedback to users in case of a submission error. For instance, if a bot is detected, you might want to display aerror message or redirect to a custom error page.

5. Summary

The spatie/laravel-honeypot package is a powerful tool for preventing spam and automated abuse in Laravel applications. By adding honeypot fields to your forms and validating them in your controllers, you can effectively prevent bots and ensure your forms are secure.