I have a form on a website thats getting used 5000+ times a day but every day I get 5-10 people email in saying they are getting blocked by my security measures and I don't understand how (and it never lets them through each and every day).
Process:
#1. User enter page with form, I set a session variable with a random string, I add this random string to a hidden form value.
#2. User submits form and I check the hidden post value against the users session value, if they match I process if they do not match I throw an error. The session value is also cleared when they hit this page.
The only thing I can figure would even possibly cause this for normal users would be:
#1. Double submitting the form - it may unset the session after loading the next page but resubmit and they see the second resubmit which does not have session var anymore because it was removed on the first submit.
#2. On the second page they use the browser back button and repost the form, thus same thing happens in #1, session is gone and does not matched the POST.
#3. They tried to submit a form from a different website.
However, when I tell users this they say they are not double submitting or using the back button or using a different website. I cannot think of what else would cause this to happen. Can anyone else think of any reason this would be blocking a few users each day when it works for 99.9%~ of everyone else?
Thank you for your time.
