I have a bit of a security design question! I have a form open to the public that can accept files. On submit of the form, I use Javascript to scrape all the data/files that the user would like to submit, and then I use AJAX to save the data/files to my server/database. As this is public, I would like to defend it from being attacked and having tons of bogus files and data being sent to it from black hat hackers. I've made some preparations to limit the numbers of files uploaded by keeping track of the number of files uploaded in the session scope, but I'm still unaware of anything else I could be doing. Any advice for a young dev?

TBH, I would not allow unauthenticated file uploads. A bot who ignores cookies will get a new session every time.

I would start with some sort of "I'm not a robot" check

Got it

+1 for captcha/bot detection, and possibly rate-limiting as well. Storing the files not in the server filesystem (e.g,, in a DB or S3/GCP bucket) might be a good idea too. (Potentially lots more, around limiting the size and type of files you accept.) And keep in mind, that anything you do in JavaScript is just a client-side control, and can be bypassed by a malicious client. For example, someone can just bypass whatever the Javascript does and send the final AJAX request(s).

To expand on what Brad said, check your cookie scope. On most of the sites I manage, if a user only presents these 3 cookies - CFID,CFTOKEN,JSESSIONID (on ACF 2016/2018) than I treat them as if they were a bot. That said, most of the sites I manage have trackers (bing search/FB/Google Analytics) and typically have lots of cookies being set

That's true about the Javascript having the potential to be controlled by a malicious client. In CFML, I'm sanitizing filenames and checking extensions to prevent spoofing of filetypes. I also check file size and the number of files sent in the current session. I've not looked into the cookie scope very much. I'll have to see what I can do there.

Also - depending on how you take/process the file data and what functions you use, you'll want to assure you're consuming a file object (data) and not a path/URL, to avoid potential server-side request forgery. (see https://hoyahaxa.blogspot.com/2021/04/ssrf-in-coldfusioncfml-tags-and.html)

Thanks for the assistance on this! Have a good weekend.

Re-Captcha V3 is pretty much invisible to "real" users - fyi