Nonces are an easy way to stop online forms from getting spammed for whatever reason.  Nonces work by creating a random piece of data, remembering that data on the server, providing that data to the client and then REQUIRING the client provide that data when they submit the form.  The client has one shot to get this right, because the required nonce will change next time the page loads.

The Nonce Process

• Create random data
• Remember that random data
• Give that random data to the client
• Require that the client submit the random data when they submit a form

Nonces are simple, effective, and easy to implement.  I had to write a nonce algorithm today in vbscript.  Nonces couldn’t be easier.

The Generator

Here’s the nonce generator.  Paste this code into a file that’s included on all forms.

<%
Session("last_nonce") = Session("current_nonce")

sent = Request.Form("current_nonce")
valid = Session("last_nonce")

max=100000
min=1
Randomize

Session("current_nonce") = "n"&(Int((max-min+1)*Rnd+min))

%>

This snippet of code couldn’t be simpler.  Line 2 allows the application to remember the last nonce generated.  This is important, because we’ll be generating a new nonce as soon by the end of the snippet.

Line 4 saves the nonce response (sent with your form) and line 5 saves the last nonce to an easy-to-remember variable (not entirely necessary, but I’m sloppy).  The rest of the lines merely generate random numbers in a certain range.

I prepended the nonce numbers with an “n” to prevent vbscript from doing arithmetic comparisons with the numbers.

Sending the nonce in your form is also easy:

<form action="validator.asp" method="post">

<input type="hidden" name="current_nonce" value="<%=Session("current_nonce")%>" />

</form>

This merely hides the nonce in your form and submits it with the data you are collecting.

The Validator

Validating a form couldn’t be easier.  In the processing block of your vbscript, make sure sent equals valid.

<%
If sent = valid Then
' Process the form
End If
%>