Question

I want to block non-browser clients from accessing certain pages / successfully making a request.

The website content is served to authenticated users. What happens is that our user gives his credentials to our website to 3rd party – it can be another website or a mobile application – that performs requests on his behalf.

Say there is a form that the user fills out and sends a message. Can I protect this form so that the server processing the submission can tell whether the user has submitted it directly from the browser or not?

I don’t want to use CAPTCHA for usability reasons. Can I do it with some javascript?

Answer 1

You can raise the bar using javascript, but anything a browser does, an automated system can do. At the very worst, they could automate a browser, but there will almost certainly be some easier way to simulate the operation.

In any case they can record the requests that the browser sends using a proxy, and work out whatever tricks you have the javascript do.

In terms of what springs to mind (to raise the bar) (using javascript):

1. Change the location that the submit goes to.
2. Change field names around at submit time.
3. Hide fields that look like should be filled in.
4. Encrypt/obfuscate form contents at submit time.
5. Change GET to POST.

Another usability problem is that anybody who has javascript disabled won’t be able to use the service at all. That might impact usability more than a CAPTCHA.