I am developing a single page application with a behaviour similar to google Maps and I want to avoid spam as much as possible.
Users can register on my website to get access to an API KEY. Then, on their website, they can implement this single page application like this :
<script src="https://www.mywebsite.com/single_page_app.js?key=THEIR_API_KEY"></script>
(Plus a few line of javascript to bind the app to a <div>
but that's not relevant)
This single page application will be used by end-users to fill informations (options, date, email, names...) through a multi-step form. Each end-user has a session (cookie are used with CORS request) and a token is sent to the application to avoid CSRF. At the end of each step, the collected data is sent to my server with the token and saved into my database.
How can I evaluate if the data sent to my server is spam ?
I've got a few (obvious) ideas which are :
- Validate the data sent
- Analyse the time between steps and the total time spent
- Count the number of request by IP
- Look for request with the exact same data (md5 hash)
- Look for the Origin and Referrer Header (CSRF, not really spam)
Is there anything more I can do ?
Moreover, some verifications (like the number of request per IP or the duplicate data) can be time consumming as I have to look through my database.
Should these verifications be made by a CRON process after being inserted into the database or on-the-fly before inserting them into my database ?
What should I do with SPAM data ?
SPAM data can be usefull to detect futur spam, should I delete it or keep it somewhere ? For how long ?