FastSubmissionProtection

ActionController engine that facilitates rejecting spam based on how long the form submission took.

This was developed by Ian White and Nicholas Rutherford while working at Distinctive Doors who have kindly agreed to release this under the MIT-LICENSE.

In your Gemfile:

gem 'fast_submission_protection'

Specify protect_from_fast_submission to protect a create action from being submitted in less than 5 seconds. The default protection is to render a HTTP 420 page (see Rescue below).

class FeedbackController < ApplicationController
  protect_from_fast_submission 
end

You can change the delay, start and finish actions, and the rescue behaviour

class CommentsController < ApplicationController
  protect_from_fast_submission :delay => 10, :start => [:edit, :update], :finish => [:update], :rescue => false
  
  rescue_from FastSubmissionProtection::SubmissionTooFastError,
    :with => lambda {|c| c.redirect_to :edit, :alert => 'Don't comment in anger!' }
end

See FastSubmissionProtection::Controller#protect_from_fast_submission for more details.

You can start and finish the timed submission in different controllers, just set up the filters manually:

class WelcomeController < ApplicationController
  before_filter FastSubmissionProtection::StartFilter.new('abused_form'), :only => :feedback_form
end

class FeedbackController < ApplicationController
  before_filter FastSubmissionProtection::FinishFilter.new('abused_form'), :only => :feedback
end

Or, for the most fine-grained control, you can start and finish at any point

# within a controller instance
self.submission_timer('abused_form').start

# some point later, where controller is any controller instance
# will raise FastSubmissionProtection::SubmissionTooFastError if the above call was < 20 seconds ago
controller.submission_timer('abused_form', 20).finish

By default fast_submission_protection is off in test mode. You can configure it in environment files as follows:

config.action_controller.allow_fast_submission_protection = false

You can also configure it on a per controller basis:

class MyController < ApplicationController
  self.allow_fast_submission_protection = true
end

if you include FastSubmissionProtection::Rescue, the error is rescued with an error page with HTTP status 420 (enhance your calm). This is included by default when you specify protect_from_fast_submission.

The default error page resides in 'views/fast_submission_protection/error'. Simply add this page to your views directory to use a custom page.

Another option is to do something like put a message in the flash, and re-render the new page. Simply rescue_from FastSubmissionProtection::SubmissionTooFastError.

Grab the project, use the last known good set of deps, and run the specs:

git clone http://github.com/i2w/fast_submission_protection
cd fast_submission_protection
cp Gemfile.lock.development Gemfile.lock
bundle
rake

This project uses the MIT-LICENSE.