Hiding email validation URL in page source

Sarah Robie

Hi - We are in the process of adding email validation functionality to all of our sign-up forms, advocacy actions, and donation forms. To do this, we must include a URL from the service that makes a call to our account and uses our contract number to activate the service. However, we realized that if someone views the code on the page, they would easily be able to find and reuse our URL with the contract number on their own forms, costing us money through our account. Has anyone found a way to hide this URL on their forms?


One idea our IT team had was to use an Amazon service called AWS Lambda to call the URL. Has anyone found success with this?

Brian Mucha

I'd ask support for the validation service about this. 


I have to think that your domain must also be whitelisted on their end or something along those lines. If this is the extent of their security I'd be looking elsewhere.


BPM

Sarah Robie

Thanks, Brian. They can whitelist by IP, but since those are dynamic that doesn't seem like a viable solution for us. They also suggested wrapping the URL on the server side, but we were told by our Blackbaud web developer that we can't access the server to do this.

Jason Thomas

Hi Sarah, 


Can you break down further what you're trying to accomplish? I was just curious. Are you saying adding the ability to verify the email the user is inputting into a form is valid?


Thanks,

Jason