mirror of
https://github.com/superseriousbusiness/gotosocial
synced 2025-06-05 21:59:39 +02:00
d8c4d9fc5a
This adds a proof-of-work based scraper deterrence to GoToSocial's middleware stack on profile and status web pages. Heavily inspired by https://github.com/TecharoHQ/anubis, but massively stripped back for our own usecase. Todo: - ~~add configuration option so this is disabled by default~~ - ~~fix whatever weirdness is preventing this working with CSP (even in debug)~~ - ~~use our standard templating mechanism going through apiutil helper func~~ - ~~probably some absurdly small performance improvements to be made in pooling re-used hex encode / hash encode buffers~~ the web endpoints aren't as hot a path as API / ActivityPub, will leave as-is for now as it is already very minimal and well optimized - ~~verify the cryptographic assumptions re: using a portion of token as challenge data~~ this isn't a serious application of cryptography, if it turns out to be a problem we'll fix it, but it definitely should not be easily possible to guess a SHA256 hash from the first 1/4 of it even if mathematically it might make it a bit easier - ~~theme / make look nice??~~ - ~~add a spinner~~ - ~~add entry in example configuration~~ - ~~add documentation~~ Verification page originally based on https://github.com/LucienV1/powtect Co-authored-by: tobi <tobi.smethurst@protonmail.com> Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4043 Reviewed-by: tobi <tsmethurst@noreply.codeberg.org> Co-authored-by: kim <grufwub@gmail.com> Co-committed-by: kim <grufwub@gmail.com>
64 lines
2.4 KiB
JavaScript
64 lines
2.4 KiB
JavaScript
/*
|
|
GoToSocial
|
|
Copyright (C) GoToSocial Authors admin@gotosocial.org
|
|
SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU Affero General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU Affero General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Affero General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
document.addEventListener('DOMContentLoaded', function() {
|
|
// Get the nollamas section container.
|
|
const nollamas = document.querySelector(".nollamas");
|
|
|
|
// Add some "loading" text to show that
|
|
// a proof-of-work captcha is being done.
|
|
const p = this.createElement("p");
|
|
p.className = "nollamas-explanation";
|
|
p.appendChild(document.createTextNode("Your browser is currently solving a proof-of-work challenge designed to deter \"ai\" scrapers. This should take no more than a few seconds..."));
|
|
nollamas.appendChild(p);
|
|
|
|
// Add a loading spinner as well if motion is allowed.
|
|
if (!window.matchMedia('(prefers-reduced-motion: reduce)').matches) {
|
|
const i = this.createElement("i");
|
|
i.className = "fa fa-2x fa-spin fa-refresh nollamas-solving";
|
|
i.setAttribute("title","Solving...");
|
|
nollamas.appendChild(i);
|
|
}
|
|
|
|
// Read the challenge and difficulty from
|
|
// data attributes on the nollamas section.
|
|
const challenge = nollamas.dataset.nollamasChallenge;
|
|
const difficulty = nollamas.dataset.nollamasDifficulty;
|
|
|
|
console.log('challenge:', challenge); // eslint-disable-line no-console
|
|
console.log('difficulty:', difficulty); // eslint-disable-line no-console
|
|
|
|
// Prepare the worker with task function.
|
|
const worker = new Worker("/assets/dist/nollamasworker.js");
|
|
worker.postMessage({
|
|
challenge: challenge,
|
|
difficulty: difficulty,
|
|
});
|
|
|
|
// Set the main worker function.
|
|
worker.onmessage = function (e) {
|
|
if (e.data.done) {
|
|
console.log('solution found for:', e.data.nonce); // eslint-disable-line no-console
|
|
let url = new URL(window.location.href);
|
|
url.searchParams.set('nollamas_solution', e.data.nonce);
|
|
window.location.href = url.toString();
|
|
}
|
|
};
|
|
});
|