This lesson's interactive features are locked, please to keep using them

Bot Detection

Bot detection can reduce automated abuse of application features, but it neither stops every unwanted bot nor absorbs a DDoS flood. These checks only run after traffic reaches your application, and legitimate crawlers, monitors, and API clients can look automated too.

Risk Signals

Good detection combines multiple weak signals. Any single signal is noisy – a high request rate could be a bot or a legitimate power user. Multiple signals together are more useful:

Rate pattern – requests per minute from the same source, burstiness, and timing regularity
IP and ASN reputation – known bad actors, cloud provider exit nodes, and residential proxy ranges
User agent and header consistency – automated clients often send incomplete or inconsistent headers
Behavioral patterns – session completion rate, navigation sequence, timing between actions

A suspicious IP alone isn't enough to block a request, but a suspicious IP combined with an unusual user agent and a high request rate is much more interesting.

Most companies I've worked for used an off-the-shelf cloud product for bot detection at scale instead of rolling their own.

Assignment

Bearly Secure's sign-up form accepts every request that reaches it.

Connect the bot-risk policy to sign-up.

Add this hidden companyWebsite honeypot field to the sign-up form in web/templates/auth.html:

<label hidden>
  Leave this field blank
  <input
    name="companyWebsite"
    type="text"
    tabindex="-1"
    autocomplete="off"
  />
</label>

In the POST /signup handler in internal/httpserver/auth.go, call the provided botdetection.ProtectSignup function before creating an account. Stop handling the request when the function reports that it challenged or blocked the signup.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.