# Stopping spam registration on acts\_as\_authenticated

**URL:** <https://www.ruby-forum.com/t/stopping-spam-registration-on-acts-as-authenticated/86184>\
**Category:** Rails\
**Created:** [February 20, 2007, 2:00pm UTC](https://www.ruby-forum.com/t/stopping-spam-registration-on-acts-as-authenticated/86184 "2007-02-20T14:00:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![piers](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b3f665/32.png) [@piers](https://www.ruby-forum.com/u/piers)\
**Post date:** [February 20, 2007, 2:00pm UTC](https://www.ruby-forum.com/t/stopping-spam-registration-on-acts-as-authenticated/86184/1 "2007-02-20T14:00:48Z")

</div>

Hi  
I’ve got a\_a\_a running on my site, and it’s working great, but …  
I’ve just noticed that one of the new users email addresses is a  
spammer’s address. And there are a whole batch of slightly suspect new  
users called e.g. Larry, with mail addresses as removed\_email\_address@domain.invalid,  
removed\_email\_address@domain.invalid etc.

What’s the best way to stop spam registration?  
Greg has a post here  
on using captcha and javascript, but the comments seem to suggest that  
it’s more of a load on the user than it is on the bots.  
Any ideas or pointers really appreciated  
Thanks  
Piers

---

<div class="post-metadata">

**Author:** ![piers](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b3f665/32.png) [@piers](https://www.ruby-forum.com/u/piers)\
**Post date:** [February 20, 2007, 2:24pm UTC](https://www.ruby-forum.com/t/stopping-spam-registration-on-acts-as-authenticated/86184/2 "2007-02-20T14:24:33Z")

</div>

Maybe add acount Activation via email… read this for examples:

[http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated](http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated)

---

<div class="post-metadata">

**Author:** ![piers](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b3f665/32.png) [@piers](https://www.ruby-forum.com/u/piers)\
**Post date:** [February 20, 2007, 2:36pm UTC](https://www.ruby-forum.com/t/stopping-spam-registration-on-acts-as-authenticated/86184/3 "2007-02-20T14:36:26Z")

</div>

Thorsten wrote:

> Maybe add acount Activation via email… read this for examples:
> 
> [http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated](http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated)

Thanks - I’d already added that.  
Sparkling studios seem to have the beginning of a solution here:  
[http://sas.sparklingstudios.com/articles/2006/10/01/how-to-protect-a-rails-application-against-spam-with-akismet](http://sas.sparklingstudios.com/articles/2006/10/01/how-to-protect-a-rails-application-against-spam-with-akismet)

It uses akismet, so will have a go at refactoring it for aaa and post to  
the stikipad unless anyone’s got any better ideas

---

<div class="post-metadata">

**Author:** ![piers](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b3f665/32.png) [@piers](https://www.ruby-forum.com/u/piers)\
**Post date:** [February 20, 2007, 5:43pm UTC](https://www.ruby-forum.com/t/stopping-spam-registration-on-acts-as-authenticated/86184/4 "2007-02-20T17:43:25Z")

</div>

On 20 Feb 2007, at 14:00, Piers wrote:

> captcha-validation-with-javascript"\>here  
> on using captcha and javascript, but the comments seem to suggest that  
> it’s more of a load on the user than it is on the bots.  
> Any ideas or pointers really appreciated

What I’ve done in the past and seems to work, is generate a unique id  
on the serverside (hashing Time.now for example), then putting that  
in a session variable and injecting it through a javascript function  
in a field. This won’t work on browsers with JS turned off, but it’s  
pretty good protection and the user doesn’t need to know about it  
(i.e. your actually filling in the captcha yourself through JavaScript).

Pseudo code:  
Controller show\_registration\_page:  
@unique\_id = hash\_value(Time.now)  
session[:form\_validator] = @unique\_id

View:

--- your other form fields here ---

Controller save\_registration:  
if params[:validator\_field] == session[:form\_validator]  
save\_registration  
else  
show\_message\_turn\_js\_on\_or\_stop\_trying\_to\_spam\_me  
end

Pretty easy to implement and no complaints about spamming.

Best regards

Peter De Berdt