Is allauth open to including an (optional) honeypot field on registration? about django-allauth HOT 3 OPEN

You mention "by a steady swarm of bot login attempts" and "by extended the registration form class" -- so does your honeypot solution protect only the signup form, or both?

Must admit, I don't have any actual insights on whether or not honeypot fields are still effective in 2024, but if so, then it is indeed something useful to add. Are there at all any stats / publications on this?

I guess the only setting needed would be a ACCOUNT_SIGNUP_FORM_HONEYPOT_FIELD = "phone_number" (or, "" / None to have it turned off).

from django-allauth.

Ahh my mistake in saying 'steady stream of login' it was indeed a steady stream of signups. I was able to identify them relatively easy because I have not marketed this app publically at all and have only sent it to a few close friends for 'beta testing'. The signups had garbage usernames and never verified their emails or took any other actions in the app.

To be completely honest I was slightly surprised it worked as well. I was already also looking into how to add captcha but decided to throw in the honeypot quickly as I knew captcha would be more involved just to see if it would stem the tide. I'll spend some time doing some more research on how effective honeypots actually are in general today and bring my findings back here before I start work on this.

from django-allauth.