From 174845754f4c77bff49d3d6c0710dfcfa65750b1 Mon Sep 17 00:00:00 2001
From: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed, 12 Mar 2025 16:48:32 +0000
Subject: [PATCH] auth: Add a honeypot to stop all those spam registrations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---
 src/templates/auth/join.html | 10 ++++++++++
 src/web/auth.py              |  5 +++++
 2 files changed, 15 insertions(+)

diff --git a/src/templates/auth/join.html b/src/templates/auth/join.html
index 2ff60be8..08ac9257 100644
--- a/src/templates/auth/join.html
+++ b/src/templates/auth/join.html
@@ -98,6 +98,16 @@
 							</div>
 						</div>
 
+						{# Honeypot Field #}
+						<div class="block">
+							<div class="field">
+								<p class="control">
+									<input class="input is-hidden" type="text" name="honey"
+										placeholder="{{ _("Give me honey") }}">
+								</p>
+							</div>
+						</div>
+
 						<div class="field">
 							<div class="control">
 								<button class="button is-primary is-medium is-fullwidth">
diff --git a/src/web/auth.py b/src/web/auth.py
index 126673b7..76cc9129 100644
--- a/src/web/auth.py
+++ b/src/web/auth.py
@@ -91,6 +91,11 @@ class JoinHandler(base.AnalyticsMixin, base.BaseHandler):
 		first_name = self.get_argument("first_name")
 		last_name  = self.get_argument("last_name")
 
+		# If the honey field has been set, we probably have a bot
+		honey = self.get_argument("honey", None)
+		if honey:
+			raise tornado.web.HTTPError(503)
+
 		# Register account
 		try:
 			with self.db.transaction():
-- 
2.47.3