What problem are you trying to solve with cookies and how does it relate to the "Contact Us" form?

If you just have an input form into which people can enter their question and their email address for the response, what do you need cookies for? Maybe my idea of a "Contact Us" form is different from yours.

Thanks for your reply.

The contact form will probably using "image verification" which uses cookies for session management.

Several folks I have been conversing with are tired of the spam they receive from their 'Contact Us' and other forms (e.g. bogus account signups, multiple submissions, bots, etc.), so I'm trying to be proactive.

If you are concerned about locking people out who might not want to or are not able to receive cookies then you should equally be concerned about those people who you are deliberately excluding by using "image verification" (Known as CAPTCHA to most of us.) CAPTCHA is documented as being inaccessible to a significant proportion of the population, and is also not as secure as many people seem to think they are. To be honest the inaccessibility issue should make most people think twice about using them these days as a number of countries have laws requiring equality of access to web sites.

/J\

"Hello, I am a blind person and I'm unable to navigate your website"

I would deal with the problem when it comes to it instead of overdesigning the most basic functionality people need to tell you about faults with the website. As long as your Contact Us form does not send mail and maybe has some (IP-based) throttling, it should be possible to stem a flood of bots.

Several folks I have been conversing with are tired of the spam they receive from their 'Contact Us' and other forms (e.g. bogus account signups, multiple submissions, bots, etc.), so I'm trying to be proactive.

If it really is just a 'Contact Us' form I wouldn't worry. There's a reason for evil folk to attack account registration forms - but contact us forms? Very rarely a problem in my experience.

Simple answer : Yes

Long answer : If you actually want users to contact you, you should ensure the lowest possible barrier to entry. That includes no javascript, no cookies, no 'mailto:' form actions, no CAPTCHAs, etc.

I would assume that your contact form mails to a limited list of people, and doesn't take a 'to' e-mail address from the form itself. (you might take an 'about' (subject) heading from the form, and translate that behind the scenes to the appropriate e-mail address, but don't accept a tainted e-mail)

If so, the only people they can spam are your company -- and when you have someone flooding one mailbox, it's annoying, but easily deleted. They'd have been able to have done it just as easily by getting an e-mail address of an employee there, or waiting for you to respond to the form submission, and then flooding you.

I don't know your exact situation, and why you believe there to be this need, but I don't think CAPTCHAs are the way to go (especially because they needlessly exclude people with poor vision). I'd suggest instead taking a look at Limit submissions over time?.

My WebApps rely heavily on sessioning too, but it is easy to get around the cookie issue. Cookies are nice, and I find about 92% of visitors to my main App have cookies enabled - provided the cookie domain and the browsed domain are identical. But you CAN maintain session state using parameters, you don't need to use cookies.

jdtoronto

For my 'Contact Us', I'm using a helpdesk ticket software that requires registration before posting.

The issues I've heard about is with people with too much time on their hands spamming the signups form with no intention of logging in, leaving alot of fake accounts setup in system. I'm trying to institute safeguards up-front to prevent this.

What I'd like to do now after reading the wonderful feedback in this thread, is to find a way to limit submissions -- both on the signup page AND the ticket submissions page. For a 'Contact Us' page for legitimate visitors, I would like a way that doesn't use cookies IF it's deemed impractical for this purpose. If it's not impractical, I'd like to use cookies or parameters or whatever is effective.

What are the steps involved to limit submissions? Also, what's a good time period to use once the signups form has been submitted, before another can be submitted? I would probably use this technique to control the # of tickets submitted once someone is inside the system, if that feature is not already available.

I am a newbie at sessions management techniques, but am willing to learn.

Any help will be greatly appreciated.

Thanks again.