First things first, **read the below blog post** from Ned Batchelder. It was the single most useful blog post on this subject that I found: > **[http://nedbatchelder.com/text/stopbots.html](http://nedbatchelder.com/text/stopbots.html)** After finding Ned Batchelder's post I began to put his suggestions into action. This is my take take on his musings. The following post covers the following subjects: * The Honeypot * The Timestamp * The Spinner * Field Names #### Prep Before we implement the fixes, lets assume we have a something similar to the following highly simplistic example: **CreateViewModel.cs [Model]** public class CreateViewModel { [Required] public string Name { get; set; } [Required, EmailAddress] public string Email { get; set; } [Required] public string Content { get; set; } [Required] public int PostId {get; set } } **Create.cshtml [View]** @model CreateViewModel @using(Html.BeginForm()) { @Html.AntiForgeryToken() @Html.HiddenFor(m => m.PostId)

@Html.LabelFor(m => m.Name): @Html.TextboxFor(m => m.Name)

@Html.LabelFor(m => m.Email): @Html.TextboxFor(m => m.Email)

@Html.LabelFor(m => m.Email): @Html.TextAreaFor(m => m.Content)

} **Controller.cs [Post action method only]** [HttpPost, ValidateAntiForgeryToken] public ActionResult CreateComment(CreateViewModel viewModel) { if(ModelState.IsValid) { //Save the comment and redirect } return View(viewModel); } Before we start, notice I have already implemented MVC's `AntiForgeryToken` and decorated my post action method with the `[ValidateAntiForgeryToken]` attribute to prevent [Cross Site Request Forgery](http://blog.stevensanderson.com/2008/09/01/prevent-cross-site-request-forgery-csrf-using-aspnet-mvcs-antiforgerytoken-helper/) ## The Honeypot One way of thwarting the [form filling bots](http://nedbatchelder.com/text/stopbots.html#h_Form-filling_bots) is to implement a honey pot. The idea here is you have an input that is invisible to a human user but is picked up by the bots. ###Implementing the Honeypot We need to add the honeypot property to the `Model` and **validate it** as follows: public class CreateViewModel : IValidatableObject { // ...existing properties public string Honeypot { get; set; } public IEnumerable Validate(ValidationContext validationContext) { if(!String.IsNullOrEmpty(this.Honeypot)) { return new[]{new ValidationResult("An error occured")} } } } Notice we are now implementing the `IValidatableObject` interface which means we have to implement the `Validate` method. This is the method that is called when check `ModelState.IsValid` in our controller. ### 'Displaying' the Honeypot Obviously we are only displaying the honeypot to the bots, *not* the humans. @model CreateViewModel @using(Html.BeginForm()) { @* ..existing markup *@ } Above you can see that I have decided to hide the containing `div`, not the `input` itself. ## The Timestamp ###Implementing the Timestamp You might decide to implement this in a slightly less obvious way like so, below I mix up how we display `.ToString()` the timestamp public class CreateViewModel : IValidatableObject { // ...existing properties // New constructor public CreateViewModel() { // Format the datetime in an inventive way this.Timestamp = DateTime.UtcNow.toString("ffffHHMMyytssddmm"); } // New property public string Timestamp { get; set; } } Notice how I have mixed up each of the date-parts to create an unintelligible value. Refer to the [Custom Date and Time MSDN page](http://msdn.microsoft.com/en-us/library/8kb3ddd4(v=vs.110).aspx) to create your own variant. Validating the `Timestamp` propertty means we need to extend the `Validate()` method. public IEnumerable Validate(ValidationContext validationContext) { var failedValidationResult = new ValidationResult("An error occured"); var failedResult = new[] { failedValidationResult }; if(!String.IsNullOrEmpty(this.Honeypot)) { return failedResult; } DateTime timestamp; if (!DateTime.TryParseExact(this.Timestamp, "ffffHHMMyytssddmm", null, DateTimeStyles.None, out commentDate)) { return failedResult; } //Check timestamp is within the last 20 minutes if (DateTime.UtcNow.AddMinutes(-20) > timestamp) { return failedResult; } } ### Adding the Timestamp to the View Next we need to add the `Timestamp` property as a hidden input to our **View** @model CreateViewModel @using(Html.BeginForm()) { @Html.HiddenFor(m => m.Timestamp) @* ..existing markup *@ } ## The Spinner Hashing the timestamp with other items adds another layer of security and makes it tamper proof should the attacker be able to decipher your custom date format. To do this we need to change our **Model**. public class CreateViewModel : IValidatableObject { public CreateViewModel() { // Format the datetime in an inventive way var timestamp = DateTime.UtcNow.toString("ffffHHMMyytssddmm"); this.Timestamp = timestamp; byte[] salt = HashHelper.CreateSalt(); // Build your spinner in which ever way you choose var toHash = String.Format("{0}{1}{2}", timestamp, Request.UserHostAddress, this.Id); //Be as creative as you please (I've added the word 'HASH') //var toHash = String.Format("H{0}A{1}S{2}H", timestamp, Request.UserHostAddress, this.Id); this.Hashed = HashHelper.Hash(toHash, salt); this.Salt = Convert.ToBase64String(salt); } // ...existing properties public string Timestamp { get; set; } public string Salt { get; set; } public string Hashed { get; set; } } As before, the additional properties need to be added to the View using the `@Html.HiddenFor()` Html helper. Additionally, the `HashHelper` used above is a custom hash helper I have built that enables the quick creation of salts and hashes and no doubt, the subject of a future post. You will need to decide how you generate your salts and hashes for your given situation. ### Validating the Spinner As before we need to update our `Validate` method to validate against our salt and hash. public IEnumerable Validate(ValidationContext validationContext) { var failedValidationResult = new ValidationResult("An error occured"); var failedResult = new[] { failedValidationResult }; if(!String.IsNullOrEmpty(this.Honeypot) || String.IsNullOrEmpty(this.Timestamp) || String.IsNullOrEmpty(this.Salt) || String.IsNullOrEmpty(this.Hashed)) { // Some expected data is missing return failedResult; } DateTime timestamp; if (!DateTime.TryParseExact(this.Timestamp, "ffffHHMMyytssddmm", null, DateTimeStyles.None, out timestamp)) { // TImestamp no longer matches our custom format return failedResult; } //Check timestamp is within the last 20 minutes if (DateTime.UtcNow.AddMinutes(-20) > timestamp) { // Form timestamp is older the 20minutes ago return failedResult; } byte[] salt = Convert.FromBase64String(this.Salt); // Remember to use the same format you did when building the hash var toHash = String.Format("{0}{1}{2}", this.Timestamp, Request.UserHostAddress, this.Id); //var toHash = String.Format("H{0}A{1}S{2}H", this.Timestamp, Request.UserHostAddress, this.Id); var hashed = HashHelper.Hash(toHash, salt); //Check the hash and salt have not been tampered with // If anything has changed or been altered, the hashes will not match if(this.Hashed.Equals(Convert.ToBase64String(hashed))) { // Hashes match, all is good return new[]{ValidationResult.Success}; } return failedResult; } ### Adding the Hash and Salt to the View We now need to add the properties to our form: @model CreateViewModel @using(Html.BeginForm()) { @Html.HiddenFor(m => m.Timestamp) @Html.HiddenFor(m => m.Salt) @Html.HiddenFor(m => m.Hashed) @* ..existing markup *@ } So now our form has everything we need added to it and the validation has been implemented. There is just one more task to complete. ## Field names In order to remove the obvious field names, we could hash them with a secret, and a spinner, however I chose to simply use random property names. This changes every aspect of our code. Our final structure might look like this: **Model** public class CreateViewModel : IValidatableObject { public CreateViewModel() { // Format the datetime in an inventive way var timestamp = DateTime.UtcNow.toString("ffffHHMMyytssddmm"); this.PWHJVT = timestamp; byte[] salt = HashHelper.CreateSalt(); // Build your spinner in which ever way you choose var toHash = String.Format("{0}{1}{2}", timestamp, Request.UserHostAddress, this.Id); //Be as creative as you please (I've added the word 'HASH') //var toHash = String.Format("H{0}A{1}S{2}H", timestamp, Request.UserHostAddress, this.Id); this.BHVESH = HashHelper.Hash(toHash, salt); this.BSRGVS = Convert.ToBase64String(salt); } [Required(ErrorMessage = "The Name field is required")] public string VJKSDN { get; set; } [Required(ErrorMessage = "The Email field is required")] [EmailAddress(ErrorMessage = "The Email field is not valid")] public string GOVSWE { get; set; } [Required(ErrorMessage = "The Content field is required")] public string BPASCC { get; set; } [Required] public int ESVERI {get; set } public string SGEGEH { get; set; } // Honeypot public string PWHJVT { get; set; } // Timestamp public string BSRGVS { get; set; } // Salt public string BHVESH { get; set; } // Hash public IEnumerable Validate(ValidationContext validationContext) { var failedValidationResult = new ValidationResult("An error occured"); var failedResult = new[] { failedValidationResult }; if(!String.IsNullOrEmpty(this.SGEGEH) || String.IsNullOrEmpty(this.PWHJVT) || String.IsNullOrEmpty(this.BSRGVS) || String.IsNullOrEmpty(this.BHVESH)) { // Some expected data is missing return failedResult; } DateTime timestamp; if (!DateTime.TryParseExact(this.PWHJVT, "ffffHHMMyytssddmm", null, DateTimeStyles.None, out timestamp)) { // TImestamp no longer matches our custom format return failedResult; } //Check timestamp is within the last 20 minutes if (DateTime.UtcNow.AddMinutes(-20) > timestamp) { // Form timestamp is older the 20 minutes ago return failedResult; } byte[] salt = Convert.FromBase64String(this.BSRGVS); // Remember to use the same format you did when building the hash var toHash = String.Format("{0}{1}{2}", this.PWHJVT, Request.UserHostAddress, this.Id); //var toHash = String.Format("H{0}A{1}S{2}H", this.PWHJVT, Request.UserHostAddress, this.Id); var hashed = HashHelper.Hash(toHash, salt); //Check the hash and salt have not been tampered with // If anything has changed or been altered, the hashes will not match if(this.BHVESH.Equals(Convert.ToBase64String(hashed))) { // Hashes match, all is good return new[]{ValidationResult.Success}; } return failedResult; } } **View** @model CreateViewModel @using(Html.BeginForm()) { @Html.AntiForgeryToken() @Html.HiddenFor(m => m.ESVERI) @Html.HiddenFor(m => m.PWHJVT) @Html.HiddenFor(m => m.BSRGVS) @Html.HiddenFor(m => m.BHVESH)

@Html.LabelFor(m => m.VJKSDN): @Html.TextboxFor(m => m.VJKSDN)

@Html.LabelFor(m => m.GOVSWE): @Html.TextboxFor(m => m.GOVSWE)

@Html.LabelFor(m => m.BPASCC): @Html.TextAreaFor(m => m.BPASCC)

} ## Conclusion Hopefully the above post will help you protect your sites from spam bots. Remember, this will not stop humans with malicious intent. If a human does try and take advantage of your site, make sure you have protected your output. For instance, if you are building a comment system, when you are writing out the comment, make sure you use `@Html.Encode(m => m.Content)` to encode any `html` or scripts that might get posted. **Final thought** I'd love to hear from anyone out there this as this post is merely my take on Ned's post for an ASP.Net MVC environment. If there is enough interest I may follow this up with new oss project that makes it easy to make any class adhere to these rules as we could create custom html helpers and a base spam-proof class to base models on. Let me know if that is something you think might be worth looking further into. Thanks for reading this lengthy post. I hope it helped.

How to stop spam bots from submitting your form in mvc