Skip to content

Commit fe780c7

Browse files
committed
AGGRESSIVE TOKEN FILTERING: Remove all hidden fields, enhance filtering, add debugging
1 parent b51ae85 commit fe780c7

2 files changed

Lines changed: 12 additions & 6 deletions

File tree

index.html

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -649,8 +649,6 @@ <h3>Contact Me</h3>
649649
<span class="close">&times;</span>
650650
</div>
651651
<form id="contact-form" action="https://athn.netlify.app/.netlify/functions/turnstile" method="POST">
652-
<input type="hidden" name="_next" value="https://athn.dev#contact-sent">
653-
<input type="hidden" name="_subject" value="New contact form submission">
654652
<div class="form-group">
655653
<label for="name">Name</label>
656654
<input type="text" id="name" name="name" required placeholder="Your name">

netlify/functions/turnstile.mjs

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,22 +57,30 @@ export default async (req, context) => {
5757

5858
// If verification successful, forward the form data to Web3Forms
5959
console.log('Forwarding to Web3Forms...');
60+
console.log('All received form data:', Array.from(formData.entries()).map(([key, value]) => `${key}: ${value.substring(0, 50)}${value.length > 50 ? '...' : ''}`));
6061

6162
// Create clean form data for Web3Forms (only include form fields, not tokens)
6263
const cleanFormData = new URLSearchParams();
6364

6465
// Add Web3Forms access key
6566
cleanFormData.append('access_key', process.env.WEB3FORMS_ACCESS_KEY);
6667

67-
// Add only the form fields we want (exclude Turnstile and other hidden tokens)
68-
const allowedFields = ['name', 'email', 'message', '_next', '_subject'];
68+
// Add custom subject line
69+
cleanFormData.append('subject', 'New contact form submission from athn.dev');
70+
71+
// Add only the core form fields (exclude ALL Turnstile and token-related fields)
72+
const allowedFields = ['name', 'email', 'message'];
6973
for (const [key, value] of formData.entries()) {
70-
if (allowedFields.includes(key)) {
74+
// Only allow specific form fields, reject anything that looks like a token
75+
if (allowedFields.includes(key) && !key.includes('turnstile') && !key.includes('token') && !key.includes('response')) {
7176
cleanFormData.append(key, value);
77+
console.log(`Including field: ${key} = ${value}`);
78+
} else {
79+
console.log(`Filtering out field: ${key} (${value.length} chars)`);
7280
}
7381
}
7482

75-
console.log('Clean form data keys:', Array.from(cleanFormData.keys()));
83+
console.log('Final clean form data keys:', Array.from(cleanFormData.keys()));
7684

7785
const web3formsResponse = await fetch('https://api.web3forms.com/submit', {
7886
method: 'POST',

0 commit comments

Comments
 (0)