[PR #4970] [MERGED] Honeypot against Bot registrations #6435

New Issue

OVERLORD · 2026-02-05T10:32:12+03:00

OVERLORD commented

2026-02-05 10:32:12 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/4970
Author: @nesges
Created: 4/22/2024
Status: ✅ Merged
Merged: 5/4/2024
Merged by: @ssddanbrown

Base: development ← Head: development

📝 Commits (4)

1b1cb18 fixed mislabeling of name input
31272e6 add ambrosia-container to registration form as honeypot for bots: new form field "username" must not be filled
16399b6 better accessibility for honepot formfield
0d2a268 whitespace only

📊 Changes

3 files changed (+22 additions, -2 deletions)

View changed files

📝 app/Access/Controllers/RegisterController.php (+1 -0)
📝 resources/sass/_forms.scss (+15 -1)
📝 resources/views/auth/register.blade.php (+6 -1)

📄 Description

This PR introduces a form-field named "username" to the registration form. This field must not be filled, but it acts as a honeypot for bots. If it is filled the Validator of RegisterController would invalidate a registration attempt. To the human viewer the honeypot is made invisible through css.

The CSS deliberately omits display:none because it can be assumed that bots would easily recognize this. Instead it used a similar CSS like Bootstraps visually-hidden class.

Caveat: To ensure that the form remains accessible, aria-hidden=true is used to tell screenreaders to ignore the honeypot. Bots may be programmed intelligently enough to recognize the attribute and ignore the field. But I do think that accessibility comes first and I haven't seen a bot that recognizes aria-hidden yet

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/4970 **Author:** [@nesges](https://github.com/nesges) **Created:** 4/22/2024 **Status:** ✅ Merged **Merged:** 5/4/2024 **Merged by:** [@ssddanbrown](https://github.com/ssddanbrown) **Base:** `development` ← **Head:** `development` --- ### 📝 Commits (4) - [`1b1cb18`](https://github.com/BookStackApp/BookStack/commit/1b1cb18839d813ba112617d6c99daece07b080d3) fixed mislabeling of name input - [`31272e6`](https://github.com/BookStackApp/BookStack/commit/31272e60b6f4685ec7a0378553ff57860cd5e387) add ambrosia-container to registration form as honeypot for bots: new form field "username" must not be filled - [`16399b6`](https://github.com/BookStackApp/BookStack/commit/16399b63be640fbe934ada9da1e8cc4f36b2c8d7) better accessibility for honepot formfield - [`0d2a268`](https://github.com/BookStackApp/BookStack/commit/0d2a268be09ed1ec55e90f2bd085d6e5034d0660) whitespace only ### 📊 Changes **3 files changed** (+22 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `app/Access/Controllers/RegisterController.php` (+1 -0) 📝 `resources/sass/_forms.scss` (+15 -1) 📝 `resources/views/auth/register.blade.php` (+6 -1) </details> ### 📄 Description This PR introduces a form-field named "username" to the registration form. This field must not be filled, but it acts as a honeypot for bots. If it is filled the Validator of RegisterController would invalidate a registration attempt. To the human viewer the honeypot is made invisible through css. The CSS deliberately omits `display:none` because it can be assumed that bots would easily recognize this. Instead it used a similar CSS like Bootstraps visually-hidden class. Caveat: To ensure that the form remains accessible, aria-hidden=true is used to tell screenreaders to ignore the honeypot. Bots may be programmed intelligently enough to recognize the attribute and ignore the field. But I do think that accessibility comes first and I haven't seen a bot that recognizes aria-hidden yet --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:32:12 +03:00

OVERLORD closed this issue

2026-02-05 10:32:14 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#6435