How to stop bots from posting and causing exceptions

Question

I have a form where anyone can fill in a review about something and this form is not inside a login area.

I started to use captcha after more and more bots was trying to input spam. The problem now is that some sort of bot just isn't giving up. I receive loads of exception emails everyday since the bot tries to input "dangerous" data and .NET doesn't allow this because the request is validated. The captcha doesn't help at all since it doesn't even need to be filled in to try to make a post which will cause an exception. The bot doesn't seem to understand that it fails everytime.

Yesterday I tried changing the names of the text boxes and I also added a "honeypot". But it's the same problem as with captcha, the exception occurs before anything is actually posted to the code behind.

Should I really have to set ValidateRequest="false" to enable the bot to make it a step further and maybe stop making requests?

All ideas are very appreciated.

Answer 1

You can either:

• Set ValidateRequest="false" on the page, opening up the possibility of XSS.
• Override the Page_Error() and then capture the exception and deal with it in your own way.

I think you might have to combine the 2 to get this to work.

protected void Page_Error(object sender, EventArgs e)
{
  Exception oops = Server.GetLastError();

  if(oops.GetBaseException() is System.Web.HttpRequestValidationException) 
  {
    System.Diagnostics.Debug.Assert(false);
  }
}