1
2
3
4
5
6
7
// prevent bots from re-submitting a form
const KV = context.cloudflare.env.KV;
const ipKey = `contact_ip_${clientIP}`;
if (await KV.get(ipKey)) {
  console.warn(`IP ${clientIP} has been flagged as a bot`);
  return Response.json({ success: true });
}

1
2
3
4
5
if (!(await schema.validate(data))) {
  console.warn("Client-side form validation bypassed");
  await KV.put(ipKey, "bot", { expirationTtl: 86400 }); // 24 hours cooldown
  return Response.json({ success: true });
}

1
2
3
4
5
// generate nonce on contact form page render
const timestamp = Date.now();
const randomPart = Math.random().toString(36).substring(2, 15);
const nonce = `${timestamp}.${randomPart}`;
await KV.put(nonceKey, "unused")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
/**
 * Validates if a nonce is valid and not expired
 * @param nonce The nonce to validate
 * @param maxAge Maximum age of the nonce in milliseconds (default: 1 hour)
 * @returns Boolean indicating if the nonce is still valid
 */
export function isNonceValid(nonce: string, maxAge: number = 3600000): boolean {
  try {
    const parts = nonce.split(".");
    if (parts.length !== 2) return false;
    const timestamp = parseInt(parts[0], 10);
    const now = Date.now();
    // Check if nonce has expired
    return now - timestamp <= maxAge;
  } catch (error) {
    return false;
  }
}
...
if (!isNonceValid(nonce)) {
  console.warn("Expired nonce detected");
  return Response.json({
    success: false,
    error: t("contact.response.error.sessionExpired"),
  });
}
const nonceKey = `contact_nonce_${nonce}`;
const nonceState = await KV.get(nonceKey);
if (nonceState === "unused") {
  await KV.put(nonceKey, "used");
} else if (nonceState === "used") {
  console.warn("Duplicate form submission");
  return Response.json(
    {
      success: false,
      error: "The form has already been submitted"
    },
    { status: 409, headers: { "Content-Type": "application/json" } }
  );
} else {
  console.warn("Invalid nonce");
  return Response.json(
    {
      success: false,
      error: "Invalid nonce submitted"
    },
    { status: 409, headers: { "Content-Type": "application/json" } }
  );
}

1
2
3
4
5
6
const rateLimiter = context.cloudflare.env.RATE_LIMITER_CONTACT;
const clientIP = request.headers.get("CF-Connecting-IP") || "";
const rateLimitResult = await rateLimiter.limit({ key: `contact_form_${clientIP}`});
if (!rateLimitResult.success) {
  // Return 429 Too Many Requests
}

1
2
3
4
[env.production]
kv_namespaces = [
  { binding = "RATE_LIMITER_CONTACT", id = "unique-namespace-id" }
]

1
2
3
4
5
6
7
8
// Check honeypot field - if it contains data, it's likely a bot
const honeypotField = data.website?.toString();
if (honeypotField) {
  console.warn("Honeypot field triggered");
  await KV.put(ipKey, "bot", { expirationTtl: 86400 }); // 24 hours cooldown      
  // Return success to avoid giving bots feedback, but don't process the form
  return Response.json({ success: true });
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
// In the form component
<HCaptcha
  ref={captchaRef}
  sitekey={process.env.HCAPTCHA_SITE_KEY || "10000000-ffff-ffff-ffff-000000000001"}
 class="hljs-function">(token) => setCaptchaToken(token)}
/>
// In the submission handling
const captchaResult = await validateCaptcha(data.hCaptchaToken.toString());
if (!captchaResult.success) {
  return Response.json({
    success: false,
    error: "CAPTCHA verification failed",
  });
}

1
2
3
4
5
6
7
8
// Validate email with mailchecker
const email = data.email?.toString() || "";
if (email && !mailchecker.isValid(email)) {
  return Response.json({
    success: false,
    error: "Please use a valid email address",
  });
}

1
2
3
4
5
6
7
8
9
email: yup
  .string()
  .email(messages.email.invalid)
  .required(messages.email.required)
  .test(
    "is-valid-email",
    "Email appears to be invalid or disposable",
    (value) => (value ? mailchecker.isValid(value) : true)
  ),