Security with Go

HTTP form field honeypots

In the previous example, we talked about creating a fake login form to detect someone attempting to log in. What if we want to identify whether it is a bot or not? The ability to detect a bot trying to log in can also be useful on a production site to block bots. One method of identifying automated bots is to use honeypot form fields. Honeypot form fields are input fields on an HTML form, which are hidden from the user and expected to be blank when the form is submitted by a human. A bot will still find the honeypot fields in the form and try to fill them out.

The goal is to trick bots into thinking that the form fields are real while keeping it hidden from users. Some bots will use regular expressions to look for ...