Changing magic link endpoint to reduce spam signups

Developer help Self-hosting
1

Has anyone tried this approach? If so, did it work?

My blog continues to be inundated with spam signups (valid gmail addresses that never confirm, and occasionally complain), and there does not seem to be a discernible pattern to to the IP/user agent that the latest batch of spam signups are coming from.

However, it occurred to me that if I changed the magic link endpoint in core/server/web/members/app.js and portal.min.js (this would require self-hosting the portal JS rather than using jsdeliver), spammers would need to be targeting my blog in specific rather than just spamming Ghost blogs in general.

If this does work, perhaps an option could be added to Ghost to randomize/customize this endpoint.

2

I have implemented this to test it out. So far so good!

To grab the latest portal.min.js and edit it, I run:

curl "https://cdn.jsdelivr.net/ghost/portal@latest/umd/portal.min.js" -o portal.min.js && sed -i 's|send-magic-link|NEWENDPOINT|g' portal.min.js

From my Dockerfile:

FROM 'ghost:6-alpine'
RUN apk add sed
RUN sed -i 's|send-magic-link|NEWENDPOINT|g' current/core/server/web/members/app.js
COPY portal.min.js content/public/portal.min.js # this doesn't work for some reason
COPY portal.min.js content/themes/laminim/portal.min.js
RUN apk del sed

And the final step is to set the new portal url via environment variable or config.production.json. In my case:

fly secrets set portal__url="/portal.min.js"
1 Like